Add fluent-bit and VictoriaLogs (#305)

![Screenshot 2024-08-28 at 15-10-20 Explore - vlog-generic -
Grafana](https://github.com/user-attachments/assets/4ba926d3-fb56-411b-88d5-a00d5d17b3dc)

---------

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

packages/extra/monitoring/Chart.yaml

@@ -3,4 +3,4 @@ name: monitoring
 description: Monitoring and observability stack
 icon: /logos/monitoring.svg
 type: application
-version: 1.3.0
+version: 1.4.0

packages/extra/monitoring/Makefile

@@ -5,6 +5,6 @@ include ../../../scripts/package.mk
 generate:
 	readme-generator -v values.yaml -s values.schema.json.tmp -r README.md
 	cat values.schema.json.tmp | \
-		jq '.properties.metricsStorages.items.type = "object"' \
+		jq '.properties.metricsStorages.items.type = "object" | .properties.logsStorages.items.type = "object"' \
 		> values.schema.json
 	rm -f values.schema.json.tmp

packages/extra/monitoring/README.md

@@ -8,4 +8,5 @@
 | ----------------- | --------------------------------------------------------------------------------------------------------- | ------- |
 | `host`            | The hostname used to access the grafana externally (defaults to 'grafana' subdomain for the tenant host). | `""`    |
 | `metricsStorages` | Configuration of metrics storage instances                                                                | `[]`    |
+| `logsStorages`    | Configuration of logs storage instances                                                                   | `[]`    |
 | `oncall.enabled`  | Enable Grafana OnCall                                                                                     | `false` |

packages/extra/monitoring/templates/grafana/grafana.yaml

@@ -26,11 +26,34 @@ spec:
     security:
       admin_user: user
       admin_password: ${GF_PASSWORD}
+    plugins:
+      allow_loading_unsigned_plugins: "victorialogs-datasource"
   deployment:
     spec:
       replicas: 2
       template:
         spec:
+          initContainers:
+            - name: "load-vm-ds-plugin"
+              image: "curlimages/curl:7.85.0"
+              command: [ "/bin/sh" ]
+              workingDir: "/var/lib/grafana"
+              securityContext:
+                runAsUser: 10001
+                runAsNonRoot: true
+                runAsGroup: 10001
+              args:
+                - "-c"
+                - |
+                  set -ex
+                  mkdir -p /var/lib/grafana/plugins/
+                  ver=$(curl -s https://api.github.com/repos/VictoriaMetrics/victorialogs-datasource/releases/latest | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+' | head -1)
+                  curl -L https://github.com/VictoriaMetrics/victorialogs-datasource/releases/download/$ver/victorialogs-datasource-$ver.tar.gz -o /var/lib/grafana/plugins/vl-plugin.tar.gz
+                  tar -xf /var/lib/grafana/plugins/vl-plugin.tar.gz -C /var/lib/grafana/plugins/
+                  rm /var/lib/grafana/plugins/vl-plugin.tar.gz
+              volumeMounts:
+                - name: grafana-data
+                  mountPath: /var/lib/grafana
           containers:
             - name: grafana
               image: grafana/grafana:10.1.0

packages/extra/monitoring/templates/oncall/oncall-release.yaml

@@ -15,9 +15,9 @@ spec:
       reconcileStrategy: Revision
       sourceRef:
         kind: HelmRepository
-        name: cozystack-extra
-        namespace: cozy-public
-      version: 0.1.0
+        name: cozystack-system
+        namespace: cozy-system
+      version: '*'
   interval: 1m0s
   timeout: 5m0s
   values:

packages/extra/monitoring/templates/vlogs/grafana-datasource.yaml

@@ -0,0 +1,15 @@
+{{- range .Values.logsStorages }}
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDatasource
+metadata:
+  name: vlogs-{{ .name }}
+spec:
+  datasource:
+    access: proxy
+    type: victorialogs-datasource
+    name: vlogs-{{ .name }}
+    url: http://vlogs-{{ .name }}.{{ $.Release.Namespace }}.svc:9428
+  instanceSelector:
+    matchLabels:
+      dashboards: grafana
+{{- end }}

packages/extra/monitoring/templates/vlogs/vlogs.yaml

@@ -0,0 +1,15 @@
+{{- range .Values.logsStorages }}
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VLogs
+metadata:
+  name: {{ .name }}
+spec:
+  storage:
+    resources:
+      requests:
+        storage: {{ .storage }}
+    storageClassName: {{ .storageClassName }}
+    accessModes: [ReadWriteOnce]
+  retentionPeriod: "{{ .retentionPeriod }}"
+  removePvcAfterDelete: true
+{{- end }}

packages/extra/monitoring/templates/vm/grafana-datasource.yaml

@@ -4,13 +4,13 @@
 apiVersion: grafana.integreatly.org/v1beta1
 kind: GrafanaDatasource
 metadata:
-  name: {{ .name }}
+  name: vm-{{ .name }}
 spec:
   instanceSelector:
     matchLabels:
       dashboards: grafana
   datasource:
-    name: {{ .name }}
+    name: vm-{{ .name }}
     type: prometheus
     access: proxy
     url: http://vmselect-{{ .name }}.{{ $.Release.Namespace }}.svc:8481/select/0/prometheus/

packages/extra/monitoring/values.schema.json

@@ -15,6 +15,14 @@
         "type": "object"
       }
     },
+    "logsStorages": {
+      "type": "array",
+      "description": "Configuration of logs storage instances",
+      "default": "[]",
+      "items": {
+        "type": "object"
+      }
+    },
     "oncall": {
       "type": "object",
       "properties": {

packages/extra/monitoring/values.yaml

@@ -17,6 +17,14 @@ metricsStorages:
   storage: 10Gi
   storageClassName: ""
 
+## @param logsStorages [array] Configuration of logs storage instances
+##
+logsStorages:
+- name: generic
+  retentionPeriod: "1"
+  storage: 10Gi
+  storageClassName: replicated
+
 ## @param oncall.enabled Enable Grafana OnCall
 ## 
 oncall:

packages/system/monitoring/Makefile

@@ -15,3 +15,7 @@ update:
 	helm repo add metrics-server https://kubernetes-sigs.github.io/metrics-server/
 	helm repo update metrics-server
 	helm pull metrics-server/metrics-server --untar --untardir charts
+	# Fluent-bit
+	helm repo add fluent https://fluent.github.io/helm-charts
+	helm repo update fluent
+	helm pull fluent/fluent-bit --untar --untardir charts

packages/system/monitoring/charts/fluent-bit/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

packages/system/monitoring/charts/fluent-bit/Chart.yaml

@@ -0,0 +1,27 @@
+annotations:
+  artifacthub.io/changes: |
+    - kind: changed
+      description: "Updated Fluent Bit OCI image to v3.1.6."
+apiVersion: v1
+appVersion: 3.1.6
+description: Fast and lightweight log processor and forwarder or Linux, OSX and BSD
+  family operating systems.
+home: https://fluentbit.io/
+icon: https://raw.githubusercontent.com/cncf/artwork/master/projects/fluentd/fluentbit/icon/fluentbit-icon-color.svg
+keywords:
+- logging
+- fluent-bit
+- fluentd
+maintainers:
+- email: eduardo@calyptia.com
+  name: edsiper
+- email: naseem@transit.app
+  name: naseemkullah
+- email: towmeykaw@gmail.com
+  name: Towmeykaw
+- email: steve.hipwell@gmail.com
+  name: stevehipwell
+name: fluent-bit
+sources:
+- https://github.com/fluent/fluent-bit/
+version: 0.47.7

packages/system/monitoring/charts/fluent-bit/README.md

@@ -0,0 +1,57 @@
+# Fluent Bit Helm chart
+
+[Fluent Bit](https://fluentbit.io) is a fast and lightweight log processor and forwarder or Linux, OSX and BSD family operating systems.
+
+## Installation
+
+To add the `fluent` helm repo, run:
+
+```sh
+helm repo add fluent https://fluent.github.io/helm-charts
+```
+
+To install a release named `fluent-bit`, run:
+
+```sh
+helm install fluent-bit fluent/fluent-bit
+```
+
+## Chart values
+
+```sh
+helm show values fluent/fluent-bit
+```
+
+## Using Lua scripts
+Fluent Bit allows us to build filter to modify the incoming records using custom [Lua scripts.](https://docs.fluentbit.io/manual/pipeline/filters/lua)
+
+### How to use Lua scripts with this Chart
+
+First, you should add your Lua scripts to `luaScripts` in values.yaml, for example:
+
+```yaml
+luaScripts:
+  filter_example.lua: |
+    function filter_name(tag, timestamp, record)
+        -- put your lua code here.
+    end
+```
+
+After that, the Lua scripts will be ready to be used as filters. So next step is to add your Fluent bit [filter](https://docs.fluentbit.io/manual/concepts/data-pipeline/filter) to `config.filters` in values.yaml, for example:
+
+```yaml
+config:
+  filters: |
+    [FILTER]
+        Name    lua
+        Match   <your-tag>
+        script  /fluent-bit/scripts/filter_example.lua
+        call    filter_name
+```
+Under the hood, the chart will:
+- Create a configmap using `luaScripts`.
+- Add a volumeMounts for each Lua scripts using the path `/fluent-bit/scripts/<script>`.
+- Add the Lua script's configmap as volume to the pod.
+
+### Note
+Remember to set the `script` attribute in the filter using `/fluent-bit/scripts/`, otherwise the file will not be found by fluent bit.

packages/system/monitoring/charts/fluent-bit/ci/ci-values.yaml

@@ -0,0 +1,7 @@
+testFramework:
+  enabled: true
+
+logLevel: debug
+
+dashboards:
+  enabled: true

packages/system/monitoring/charts/fluent-bit/templates/NOTES.txt

@@ -0,0 +1,6 @@
+Get Fluent Bit build information by running these commands:
+
+export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "fluent-bit.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 2020:2020
+curl http://127.0.0.1:2020 
+

packages/system/monitoring/charts/fluent-bit/templates/_helpers.tpl

@@ -0,0 +1,138 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "fluent-bit.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "fluent-bit.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "fluent-bit.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Common labels
+*/}}
+{{- define "fluent-bit.labels" -}}
+helm.sh/chart: {{ include "fluent-bit.chart" . }}
+{{ include "fluent-bit.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{/*
+Selector labels
+*/}}
+{{- define "fluent-bit.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "fluent-bit.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "fluent-bit.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "fluent-bit.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Fluent-bit image with tag/digest
+*/}}
+{{- define "fluent-bit.image" -}}
+{{- $tag := ternary "" (printf ":%s" (toString .tag)) (or (empty .tag) (eq "-" (toString .tag))) -}}
+{{- $digest := ternary "" (printf "@%s" .digest) (empty .digest) -}}
+{{- printf "%s%s%s" .repository $tag $digest -}}
+{{- end -}}
+
+{{/*
+Ingress ApiVersion according k8s version
+*/}}
+{{- define "fluent-bit.ingress.apiVersion" -}}
+{{- if and (.Capabilities.APIVersions.Has "networking.k8s.io/v1") (semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion) -}}
+networking.k8s.io/v1
+{{- else if and (.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1") (semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion) -}}
+networking.k8s.io/v1beta1
+{{- else -}}
+extensions/v1beta1
+{{- end }}
+{{- end }}
+
+{{/*
+Return if ingress is stable.
+*/}}
+{{- define "fluent-bit.ingress.isStable" -}}
+  {{- eq (include "fluent-bit.ingress.apiVersion" .) "networking.k8s.io/v1" -}}
+{{- end -}}
+{{/*
+Return if ingress supports ingressClassName.
+*/}}
+{{- define "fluent-bit.ingress.supportsIngressClassName" -}}
+  {{- or (eq (include "fluent-bit.ingress.isStable" .) "true") (and (eq (include "fluent-bit.ingress.apiVersion" .) "networking.k8s.io/v1beta1") (semverCompare ">= 1.18-0" .Capabilities.KubeVersion.Version)) -}}
+{{- end -}}
+{{/*
+Return if ingress supports pathType.
+*/}}
+{{- define "fluent-bit.ingress.supportsPathType" -}}
+  {{- or (eq (include "fluent-bit.ingress.isStable" .) "true") (and (eq (include "fluent-bit.ingress.apiVersion" .) "networking.k8s.io/v1beta1") (semverCompare ">= 1.18-0" .Capabilities.KubeVersion.Version)) -}}
+{{- end -}}
+
+{{/*
+Pdb apiVersion according k8s version and capabilities
+*/}}
+{{- define "fluent-bit.pdb.apiVersion" -}}
+{{- if and (.Capabilities.APIVersions.Has "policy/v1") (semverCompare ">=1.21-0" .Capabilities.KubeVersion.GitVersion) -}}
+policy/v1
+{{- else -}}
+policy/v1beta1
+{{- end }}
+{{- end -}}
+
+{{/*
+HPA ApiVersion according k8s version
+Check legacy first so helm template / kustomize will default to latest version
+*/}}
+{{- define "fluent-bit.hpa.apiVersion" -}}
+{{- if and (.Capabilities.APIVersions.Has "autoscaling/v2beta2") (semverCompare "<1.23-0" .Capabilities.KubeVersion.GitVersion) -}}
+autoscaling/v2beta2
+{{- else -}}
+autoscaling/v2
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of OpenShift SecurityContextConstraints to use
+*/}}
+{{- define "fluent-bit.openShiftSccName" -}}
+{{- if not .Values.openShift.securityContextConstraints.create -}}
+{{- printf "%s" .Values.openShift.securityContextConstraints.existingName -}}
+{{- else -}}
+{{- printf "%s" (default (include "fluent-bit.fullname" .) .Values.openShift.securityContextConstraints.name) -}}
+{{- end -}}
+{{- end -}}

packages/system/monitoring/charts/fluent-bit/templates/_pod.tpl

@@ -0,0 +1,155 @@
+{{- define "fluent-bit.pod" -}}
+serviceAccountName: {{ include "fluent-bit.serviceAccountName" . }}
+{{- with .Values.imagePullSecrets }}
+imagePullSecrets:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- if .Values.priorityClassName }}
+priorityClassName: {{ .Values.priorityClassName }}
+{{- end }}
+{{- with .Values.podSecurityContext }}
+securityContext:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- with .Values.terminationGracePeriodSeconds }}
+terminationGracePeriodSeconds: {{ . }}
+{{- end }}
+hostNetwork: {{ .Values.hostNetwork }}
+dnsPolicy: {{ .Values.dnsPolicy }}
+{{- with .Values.dnsConfig }}
+dnsConfig:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- with .Values.hostAliases }}
+hostAliases:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- with .Values.initContainers }}
+initContainers:
+{{- if kindIs "string" . }}
+  {{- tpl . $ | nindent 2 }}
+{{- else }}
+  {{-  toYaml . | nindent 2 }}
+{{- end -}}
+{{- end }}
+containers:
+  - name: {{ .Chart.Name }}
+  {{- with .Values.securityContext }}
+    securityContext:
+      {{- toYaml . | nindent 6 }}
+  {{- end }}
+    image: {{ include "fluent-bit.image" (merge .Values.image (dict "tag" (default .Chart.AppVersion .Values.image.tag))) | quote }}
+    imagePullPolicy: {{ .Values.image.pullPolicy }}
+  {{- if or .Values.env .Values.envWithTpl }}
+    env:
+    {{- with .Values.env }}
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+    {{- range $item := .Values.envWithTpl }}
+      - name: {{ $item.name }}
+        value: {{ tpl $item.value $ | quote }}
+    {{- end }}
+  {{- end }}
+  {{- if .Values.envFrom }}
+    envFrom:
+      {{- toYaml .Values.envFrom | nindent 6 }}
+  {{- end }}
+  {{- with .Values.command }}
+    command:
+      {{- toYaml . | nindent 6 }}
+  {{- end }}
+  {{- if or .Values.args .Values.hotReload.enabled }}
+    args:
+      {{- toYaml .Values.args | nindent 6 }}
+    {{- if .Values.hotReload.enabled }}
+      - --enable-hot-reload
+    {{- end }}
+  {{- end}}
+    ports:
+      - name: http
+        containerPort: {{ .Values.metricsPort }}
+        protocol: TCP
+    {{- if .Values.extraPorts }}
+      {{- range .Values.extraPorts }}
+      - name: {{ .name }}
+        containerPort: {{ .containerPort }}
+        protocol: {{ .protocol }}
+      {{- end }}
+    {{- end }}
+  {{- with .Values.lifecycle }}
+    lifecycle:
+      {{- toYaml . | nindent 6 }}
+  {{- end }}
+    livenessProbe:
+      {{- toYaml .Values.livenessProbe | nindent 6 }}
+    readinessProbe:
+      {{- toYaml .Values.readinessProbe | nindent 6 }}
+  {{- with .Values.resources }}
+    resources:
+      {{- toYaml . | nindent 6 }}
+  {{- end }}
+    volumeMounts:
+      - name: config
+        mountPath: /fluent-bit/etc/conf
+    {{- if or .Values.luaScripts .Values.hotReload.enabled }}
+      - name: luascripts
+        mountPath: /fluent-bit/scripts
+    {{- end }}
+    {{- if eq .Values.kind "DaemonSet" }}
+      {{- toYaml .Values.daemonSetVolumeMounts | nindent 6 }}
+    {{- end }}
+    {{- if .Values.extraVolumeMounts }}
+      {{- toYaml .Values.extraVolumeMounts | nindent 6 }}
+    {{- end }}
+{{- if .Values.hotReload.enabled }}
+  - name: reloader
+    image: {{ include "fluent-bit.image" .Values.hotReload.image }}
+    args:
+      - {{ printf "-webhook-url=http://localhost:%s/api/v2/reload" (toString .Values.metricsPort) }}
+      - -volume-dir=/watch/config
+      - -volume-dir=/watch/scripts
+    volumeMounts:
+      - name: config
+        mountPath: /watch/config
+      - name: luascripts
+        mountPath: /watch/scripts
+    {{- with .Values.hotReload.resources }}
+    resources:
+      {{- toYaml . | nindent 12 }}
+    {{- end }}
+{{- end }}
+{{- if .Values.extraContainers }}
+  {{- if kindIs "string" .Values.extraContainers }}
+    {{- tpl .Values.extraContainers $ | nindent 2 }}
+  {{- else }}
+    {{-  toYaml .Values.extraContainers | nindent 2 }}
+  {{- end -}}
+{{- end }}
+volumes:
+  - name: config
+    configMap:
+      name: {{ default (include "fluent-bit.fullname" .) .Values.existingConfigMap }}
+{{- if or .Values.luaScripts .Values.hotReload.enabled }}
+  - name: luascripts
+    configMap:
+      name: {{ include "fluent-bit.fullname" . }}-luascripts
+{{- end }}
+{{- if eq .Values.kind "DaemonSet" }}
+  {{- toYaml .Values.daemonSetVolumes | nindent 2 }}
+{{- end }}
+{{- if .Values.extraVolumes }}
+  {{- toYaml .Values.extraVolumes | nindent 2 }}
+{{- end }}
+{{- with .Values.nodeSelector }}
+nodeSelector:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- with .Values.affinity }}
+affinity:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- with .Values.tolerations }}
+tolerations:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- end -}}

packages/system/monitoring/charts/fluent-bit/templates/clusterrole.yaml

@@ -0,0 +1,46 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "fluent-bit.fullname" . }}
+  labels:
+    {{- include "fluent-bit.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+      - pods
+      {{- if .Values.rbac.nodeAccess }}
+      - nodes
+      - nodes/metrics
+      - nodes/proxy
+      {{- end }}
+      {{- if .Values.rbac.eventsAccess }}
+      - events
+      {{- end }}
+    verbs:
+      - get
+      - list
+      - watch
+  {{- if and .Values.podSecurityPolicy.create (semverCompare "<=1.25-0" .Capabilities.KubeVersion.GitVersion) }}
+  - apiGroups:
+      - policy
+    resources:
+      - podsecuritypolicies
+    resourceNames:
+      - {{ include "fluent-bit.fullname" . }}
+    verbs:
+      - use
+  {{- end }}
+  {{- if .Values.openShift.enabled }}
+  - apiGroups:
+      - security.openshift.io
+    resources:
+      - securitycontextconstraints
+    resourceNames:
+      - {{ include "fluent-bit.openShiftSccName" . }}
+    verbs:
+      - use
+  {{- end }}
+{{- end -}}

packages/system/monitoring/charts/fluent-bit/templates/clusterrolebinding.yaml

@@ -0,0 +1,16 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "fluent-bit.fullname" . }}
+  labels:
+    {{- include "fluent-bit.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "fluent-bit.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "fluent-bit.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}

packages/system/monitoring/charts/fluent-bit/templates/configmap-dashboards.yaml

@@ -0,0 +1,21 @@
+
+{{- if .Values.dashboards.enabled -}}
+{{- range $path, $_ :=  .Files.Glob "dashboards/*.json" }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "fluent-bit.fullname" $ }}-dashboard-{{ trimSuffix ".json" (base $path) }}
+  namespace: {{ default $.Release.Namespace $.Values.dashboards.namespace }}
+  {{- with $.Values.dashboards.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 -}}
+  {{- end }}
+  labels:
+    {{- include "fluent-bit.labels" $ | nindent 4 }}
+    {{ $.Values.dashboards.labelKey }}: {{ $.Values.dashboards.labelValue | quote }}
+data:
+  {{ include "fluent-bit.fullname" $ }}-{{ base $path }}: |
+    {{- tpl ($.Files.Get $path) $ | nindent 4 }}
+---
+{{- end }}
+{{- end -}}

packages/system/monitoring/charts/fluent-bit/templates/configmap-luascripts.yaml

@@ -0,0 +1,13 @@
+{{- if or .Values.luaScripts .Values.hotReload.enabled -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "fluent-bit.fullname" . }}-luascripts
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluent-bit.labels" . | nindent 4 }}
+data:
+  {{ range $key, $value := .Values.luaScripts }}
+  {{ $key }}: {{ $value | quote }}
+  {{ end }}
+{{- end -}}

packages/system/monitoring/charts/fluent-bit/templates/configmap.yaml

@@ -0,0 +1,25 @@
+{{- if not .Values.existingConfigMap -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "fluent-bit.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluent-bit.labels" . | nindent 4 }}
+data:
+  custom_parsers.conf: |
+    {{- (tpl .Values.config.customParsers $) | nindent 4 }}
+  fluent-bit.conf: |
+    {{- (tpl .Values.config.service $)  | nindent 4 }}
+    {{- (tpl .Values.config.inputs $)  | nindent 4 }}
+    {{- (tpl .Values.config.filters $)  | nindent 4 }}
+    {{- (tpl .Values.config.outputs $)  | nindent 4 }}
+  {{- range $key, $val := .Values.config.upstream }}
+  {{ $key }}: |
+    {{- (tpl $val $) | nindent 4 }}
+  {{- end }}
+  {{- range $key, $val := .Values.config.extraFiles }}
+  {{ $key }}: |
+    {{- (tpl $val $) | nindent 4 }}
+  {{- end }}
+{{- end -}}

packages/system/monitoring/charts/fluent-bit/templates/daemonset.yaml

@@ -0,0 +1,48 @@
+{{- if eq .Values.kind "DaemonSet" }}
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ include "fluent-bit.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluent-bit.labels" . | nindent 4 }}
+    {{- with .Values.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "fluent-bit.selectorLabels" . | nindent 6 }}
+  {{- with .Values.updateStrategy }}
+  updateStrategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.minReadySeconds }}
+  minReadySeconds: {{ . }}
+  {{- end }}
+  template:
+    metadata:
+      labels:
+        {{- include "fluent-bit.selectorLabels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    {{- if or (not .Values.hotReload.enabled) .Values.podAnnotations }}
+      annotations:
+      {{- if not .Values.hotReload.enabled }}
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+      {{- if .Values.luaScripts }}
+        checksum/luascripts: {{ include (print $.Template.BasePath "/configmap-luascripts.yaml") . | sha256sum }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- end }}
+    spec:
+      {{- include "fluent-bit.pod" . | nindent 6 }}
+{{- end }}

packages/system/monitoring/charts/fluent-bit/templates/deployment.yaml

@@ -0,0 +1,51 @@
+{{- if eq .Values.kind "Deployment" }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "fluent-bit.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluent-bit.labels" . | nindent 4 }}
+    {{- with .Values.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  {{- with .Values.updateStrategy }}
+  strategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "fluent-bit.selectorLabels" . | nindent 6 }}
+  {{- with .Values.minReadySeconds }}
+  minReadySeconds: {{ . }}
+  {{- end }}
+  template:
+    metadata:
+      labels:
+        {{- include "fluent-bit.selectorLabels" . | nindent 8 }}
+      {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if or (not .Values.hotReload.enabled) .Values.podAnnotations }}
+      annotations:
+      {{- if not .Values.hotReload.enabled }}
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+      {{- if .Values.luaScripts }}
+        checksum/luascripts: {{ include (print $.Template.BasePath "/configmap-luascripts.yaml") . | sha256sum }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+    spec:
+      {{- include "fluent-bit.pod" . | nindent 6 }}
+{{- end }}

packages/system/monitoring/charts/fluent-bit/templates/hpa.yaml

@@ -0,0 +1,40 @@
+{{- if and  ( eq  .Values.kind "Deployment" )  .Values.autoscaling.enabled  }}
+apiVersion: {{ include "fluent-bit.hpa.apiVersion" . }}
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "fluent-bit.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluent-bit.labels" . | nindent 4 }}
+spec:
+  {{- if .Values.autoscaling.behavior }}
+  behavior:
+    {{- toYaml .Values.autoscaling.behavior | nindent 4 }}
+  {{- end }}
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "fluent-bit.fullname" . }}
+  minReplicas: {{ .Values.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
+  metrics:
+  {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+          type: Utilization
+  {{- end }}
+  {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+          type: Utilization
+  {{- end }}
+  {{- if .Values.autoscaling.customRules -}}
+    {{- toYaml .Values.autoscaling.customRules | nindent 4}}
+  {{- end -}}
+{{- end }}

packages/system/monitoring/charts/fluent-bit/templates/ingress.yaml

@@ -0,0 +1,65 @@
+{{- $ingressApiIsStable := eq (include "fluent-bit.ingress.isStable" .) "true" -}}
+{{- $ingressSupportsIngressClassName := eq (include "fluent-bit.ingress.supportsIngressClassName" .) "true" -}}
+{{- $ingressSupportsPathType := eq (include "fluent-bit.ingress.supportsPathType" .) "true" -}}
+{{- $fullName := include "fluent-bit.fullname" . -}}
+{{- $svcPort := .Values.service.port -}}
+
+{{- if and ( eq .Values.kind "Deployment" ) .Values.ingress.enabled }}
+apiVersion: {{ include "fluent-bit.ingress.apiVersion" . }}
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluent-bit.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+  {{- range $key, $value := . }}
+    {{ printf "%s: %s" $key ((tpl $value $) | quote) }}
+  {{- end }}
+  {{- end }}
+spec:
+  {{- if and $ingressSupportsIngressClassName .Values.ingress.ingressClassName }}
+  ingressClassName: {{ .Values.ingress.ingressClassName }}
+  {{- end -}}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      {{- with .secretName }}
+      secretName: {{ . }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range concat .Values.ingress.hosts .Values.ingress.extraHosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          - path: /
+            {{- if $ingressSupportsPathType }}
+            pathType: Prefix
+            {{- end }}
+            backend:
+              {{- if $ingressApiIsStable }}
+              service:
+                name: {{ $fullName }}
+                port:
+                  {{- if .port }}
+                  number: {{ .port }}
+                  {{- else }}
+                  number: {{ $svcPort }}
+                  {{- end }}
+              {{- else }}
+              serviceName: {{ $fullName }}
+              {{- if .port }}
+              servicePort: {{ .port }}
+              {{- else }}
+              servicePort: {{ $svcPort }}
+              {{- end }}
+              {{- end }}
+    {{- end }}
+{{- end }}

packages/system/monitoring/charts/fluent-bit/templates/networkpolicy.yaml

@@ -0,0 +1,23 @@
+{{- if .Values.networkPolicy.enabled }}
+apiVersion: "networking.k8s.io/v1"
+kind: "NetworkPolicy"
+metadata:
+  name: {{ include "fluent-bit.fullname" . | quote }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluent-bit.labels" . | nindent 4 }}
+spec:
+  policyTypes:
+    - "Ingress"
+  podSelector:
+    matchLabels:
+      {{- include "fluent-bit.selectorLabels" . | nindent 6 }}
+  ingress:
+    {{- with .Values.networkPolicy.ingress }}
+    - from:
+        {{- with .from }}{{- . | toYaml | nindent 8 }}{{- else }} []{{- end }}
+      ports:
+        - protocol: "TCP"
+          port: {{ $.Values.service.port }}
+    {{- end }}
+{{- end }}

packages/system/monitoring/charts/fluent-bit/templates/pdb.yaml

@@ -0,0 +1,21 @@
+{{- if and  ( eq  .Values.kind "Deployment" )  .Values.podDisruptionBudget.enabled  }}
+apiVersion: {{ include "fluent-bit.pdb.apiVersion" . }}
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "fluent-bit.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluent-bit.labels" . | nindent 4 }}
+{{- with .Values.podDisruptionBudget.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+{{- end }}
+spec:
+  maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
+  selector:
+    matchLabels:
+      {{- include "fluent-bit.selectorLabels" . | nindent 6 }}
+      {{- with .Values.labels }}
+        {{- toYaml . | nindent 6 }}
+      {{- end }}
+{{- end }}

packages/system/monitoring/charts/fluent-bit/templates/prometheusrule.yaml

@@ -0,0 +1,18 @@
+{{- if and ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) .Values.prometheusRule.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: {{ include "fluent-bit.fullname" . }}
+  namespace: {{ default $.Release.Namespace .Values.prometheusRule.namespace }}
+  labels:
+    {{- include "fluent-bit.labels" . | nindent 4 }}
+  {{- if .Values.prometheusRule.additionalLabels }}
+    {{- toYaml .Values.prometheusRule.additionalLabels | nindent 4 }}
+  {{- end }}
+spec:
+{{- if .Values.prometheusRule.rules }}
+  groups:
+  - name: {{ template "fluent-bit.name" . }}
+    rules: {{- toYaml .Values.prometheusRule.rules | nindent 4 }}
+{{- end }}
+{{- end }}

packages/system/monitoring/charts/fluent-bit/templates/psp.yaml

@@ -0,0 +1,42 @@
+{{- if and .Values.podSecurityPolicy.create (semverCompare "<=1.25-0" .Capabilities.KubeVersion.GitVersion) -}}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ include "fluent-bit.fullname" . }}
+{{- if .Values.podSecurityPolicy.annotations }}
+  annotations:
+    {{- toYaml .Values.podSecurityPolicy.annotations | nindent 4 }}
+{{- end }}
+spec:
+  privileged: false
+  # Required to prevent escalations to root.
+  allowPrivilegeEscalation: false
+  # This is redundant with non-root + disallow privilege escalation,
+  # but we can provide it for defense in depth.
+  requiredDropCapabilities:
+    - ALL
+  volumes:
+    - '*'
+  hostNetwork: {{ .Values.hostNetwork }}
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    # TODO: Require the container to run without root privileges.
+    rule: 'RunAsAny'
+  seLinux:
+    # This policy assumes the nodes are using AppArmor rather than SELinux.
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'MustRunAs'
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  fsGroup:
+    rule: 'MustRunAs'
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  readOnlyRootFilesystem: false
+{{- end }}

packages/system/monitoring/charts/fluent-bit/templates/scc.yaml

@@ -0,0 +1,41 @@
+{{- if and .Values.openShift.enabled .Values.openShift.securityContextConstraints.create }}
+apiVersion: security.openshift.io/v1
+kind: SecurityContextConstraints
+metadata:
+  name: {{ include "fluent-bit.openShiftSccName" . }}
+  labels:
+    {{- include "fluent-bit.labels" . | nindent 4 }}
+  {{- with .Values.openShift.securityContextConstraints.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+allowPrivilegedContainer: true
+allowPrivilegeEscalation: true
+allowHostDirVolumePlugin: true
+defaultAllowPrivilegeEscalation: false
+# forbid host namespaces
+allowHostNetwork: false
+allowHostIPC: false
+allowHostPorts: false
+allowHostPID: false
+allowedCapabilities: []
+forbiddenSysctls:
+  - "*"
+readOnlyRootFilesystem: false
+requiredDropCapabilities:
+  - MKNOD
+runAsUser:
+  type: RunAsAny
+seLinuxContext:
+  type: MustRunAs
+supplementalGroups:
+  type: RunAsAny
+volumes:
+  - configMap
+  - downwardAPI
+  - emptyDir
+  - hostPath
+  - persistentVolumeClaim
+  - projected
+  - secret
+{{- end }}

packages/system/monitoring/charts/fluent-bit/templates/service.yaml

@@ -0,0 +1,57 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "fluent-bit.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluent-bit.labels" . | nindent 4 }}
+    {{- with .Values.service.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  {{- if and (eq .Values.service.type "ClusterIP") (.Values.service.clusterIP) }}
+  clusterIP: {{ .Values.service.clusterIP }}
+  {{- end }}
+  {{- if .Values.service.externalIPs }}
+  externalIPs: {{- toYaml .Values.service.externalIPs | nindent 4 }}
+  {{- end }}
+  {{- if (eq .Values.kind "DaemonSet") }}
+  {{- with .Values.service.internalTrafficPolicy }}
+  internalTrafficPolicy: {{ . }}
+  {{- end }}
+  {{- end }}
+  {{- if (eq .Values.service.type "LoadBalancer")}}
+  {{- with .Values.service.loadBalancerClass}}
+  loadBalancerClass: {{ . }}
+  {{- end }}
+  {{- with .Values.service.loadBalancerSourceRanges}}
+  loadBalancerSourceRanges:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- end }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+      {{- if and (eq .Values.service.type "NodePort") (.Values.service.nodePort) }}
+      nodePort: {{ .Values.service.nodePort }}
+      {{- end }}
+  {{- if .Values.extraPorts }}
+    {{- range .Values.extraPorts }}
+    - name: {{ .name }}
+      targetPort: {{ .name }}
+      protocol: {{ .protocol }}
+      port: {{ .port }}
+      {{- if and (eq $.Values.service.type "NodePort") (.nodePort) }}
+      nodePort: {{ .nodePort }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+  selector:
+    {{- include "fluent-bit.selectorLabels" . | nindent 4 }}

packages/system/monitoring/charts/fluent-bit/templates/serviceaccount.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "fluent-bit.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluent-bit.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end -}}

packages/system/monitoring/charts/fluent-bit/templates/servicemonitor.yaml

@@ -0,0 +1,51 @@
+{{- if and ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) .Values.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ template "fluent-bit.fullname" . }}
+  namespace: {{ default .Release.Namespace .Values.serviceMonitor.namespace }}
+  labels:
+    {{- include "fluent-bit.labels" . | nindent 4 }}
+    {{- with .Values.serviceMonitor.selector }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  jobLabel: app.kubernetes.io/instance
+  endpoints:
+    - port: http
+      path: {{ default "/api/v2/metrics/prometheus" .Values.serviceMonitor.path }}
+      {{- with .Values.serviceMonitor.interval }}
+      interval: {{ . }}
+      {{- end }}
+      {{- with .Values.serviceMonitor.scrapeTimeout }}
+      scrapeTimeout: {{ . }}
+      {{- end }}
+      {{- with .Values.serviceMonitor.metricRelabelings }}
+      metricRelabelings:
+      {{- if kindIs "string" . }}
+        {{- tpl . $ | nindent 8 }}
+      {{- else }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.serviceMonitor.relabelings }}
+      relabelings:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.serviceMonitor.scheme }}
+      scheme: {{ .Values.serviceMonitor.scheme }}
+      {{- end }}
+      {{- if .Values.serviceMonitor.tlsConfig }}
+      tlsConfig:
+        {{- toYaml .Values.serviceMonitor.tlsConfig | nindent 8 }}
+      {{- end }}
+    {{- with .Values.serviceMonitor.additionalEndpoints }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+  selector:
+    matchLabels:
+      {{- include "fluent-bit.selectorLabels" . | nindent 6 }}
+{{- end }}

packages/system/monitoring/charts/fluent-bit/templates/tests/test-connection.yaml

@@ -0,0 +1,26 @@
+{{- if .Values.testFramework.enabled }}
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "fluent-bit.fullname" . }}-test-connection"
+  namespace: {{ default .Release.Namespace .Values.testFramework.namespace }}
+  labels:
+    helm.sh/chart: {{ include "fluent-bit.chart" . }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+  annotations:
+    helm.sh/hook: test
+    helm.sh/hook-delete-policy: hook-succeeded
+spec:
+  containers:
+    - name: wget
+      image: {{ include "fluent-bit.image" .Values.testFramework.image | quote }}
+      imagePullPolicy: {{ .Values.testFramework.image.pullPolicy }}
+      command: ["sh"]
+      args: ["-c", "wget -O- {{ include "fluent-bit.fullname" . }}:{{ .Values.service.port }}"]
+  {{- with .Values.imagePullSecrets }}
+  imagePullSecrets:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  restartPolicy: Never
+{{- end }}

packages/system/monitoring/charts/fluent-bit/templates/vpa.yaml

@@ -0,0 +1,39 @@
+{{- if and (.Capabilities.APIVersions.Has "autoscaling.k8s.io/v1/VerticalPodAutoscaler") .Values.autoscaling.vpa.enabled }}
+apiVersion: autoscaling.k8s.io/v1
+kind: VerticalPodAutoscaler
+metadata:
+  name: {{ include "fluent-bit.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fluent-bit.labels" . | nindent 4 }}
+  {{- with .Values.autoscaling.vpa.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  resourcePolicy:
+    containerPolicies:
+    - containerName: {{ .Chart.Name }}
+      {{- with .Values.autoscaling.vpa.controlledResources }}
+      controlledResources: 
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.autoscaling.vpa.maxAllowed }}
+      maxAllowed:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.autoscaling.vpa.minAllowed }}
+      minAllowed:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+  targetRef:
+    apiVersion: apps/v1
+    kind: {{ .Values.kind }}
+    name: {{ include "fluent-bit.fullname" . }}
+  {{- if .Values.autoscaling.vpa.updatePolicy }}
+  updatePolicy:
+    {{- with .Values.autoscaling.vpa.updatePolicy.updateMode }}
+    updateMode: {{ . }}
+    {{- end }}
+  {{- end }}
+{{- end }}

packages/system/monitoring/charts/fluent-bit/values.yaml

@@ -0,0 +1,511 @@
+# Default values for fluent-bit.
+
+# kind -- DaemonSet or Deployment
+kind: DaemonSet
+
+# replicaCount -- Only applicable if kind=Deployment
+replicaCount: 1
+
+image:
+  repository: cr.fluentbit.io/fluent/fluent-bit
+  # Overrides the image tag whose default is {{ .Chart.AppVersion }}
+  # Set to "-" to not use the default value
+  tag:
+  digest:
+  pullPolicy: IfNotPresent
+
+testFramework:
+  enabled: true
+  namespace:
+  image:
+    repository: busybox
+    pullPolicy: Always
+    tag: latest
+    digest:
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+serviceAccount:
+  create: true
+  annotations: {}
+  name:
+
+rbac:
+  create: true
+  nodeAccess: false
+  eventsAccess: false
+
+# Configure podsecuritypolicy
+# Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/
+# from Kubernetes 1.25, PSP is deprecated
+# See: https://kubernetes.io/blog/2022/08/23/kubernetes-v1-25-release/#pod-security-changes
+# We automatically disable PSP if Kubernetes version is 1.25 or higher
+podSecurityPolicy:
+  create: false
+  annotations: {}
+
+# OpenShift-specific configuration
+openShift:
+  enabled: false
+  securityContextConstraints:
+    # Create SCC for Fluent-bit and allow use it
+    create: true
+    name: ""
+    annotations: {}
+    # Use existing SCC in cluster, rather then create new one
+    existingName: ""
+
+podSecurityContext: {}
+#   fsGroup: 2000
+
+hostNetwork: false
+dnsPolicy: ClusterFirst
+
+dnsConfig: {}
+#   nameservers:
+#     - 1.2.3.4
+#   searches:
+#     - ns1.svc.cluster-domain.example
+#     - my.dns.search.suffix
+#   options:
+#     - name: ndots
+#       value: "2"
+#     - name: edns0
+
+hostAliases: []
+#   - ip: "1.2.3.4"
+#     hostnames:
+#     - "foo.local"
+#     - "bar.local"
+
+securityContext: {}
+#   capabilities:
+#     drop:
+#     - ALL
+#   readOnlyRootFilesystem: true
+#   runAsNonRoot: true
+#   runAsUser: 1000
+
+service:
+  type: ClusterIP
+  port: 2020
+  internalTrafficPolicy:
+  loadBalancerClass:
+  loadBalancerSourceRanges: []
+  labels: {}
+  # nodePort: 30020
+  # clusterIP: 172.16.10.1
+  annotations: {}
+#   prometheus.io/path: "/api/v1/metrics/prometheus"
+#   prometheus.io/port: "2020"
+#   prometheus.io/scrape: "true"
+  externalIPs: []
+  # externalIPs:
+  #  - 2.2.2.2
+
+
+serviceMonitor:
+  enabled: false
+  #   namespace: monitoring
+  #   interval: 10s
+  #   scrapeTimeout: 10s
+  #   selector:
+  #    prometheus: my-prometheus
+  #  ## metric relabel configs to apply to samples before ingestion.
+  #  ##
+  #  metricRelabelings:
+  #    - sourceLabels: [__meta_kubernetes_service_label_cluster]
+  #      targetLabel: cluster
+  #      regex: (.*)
+  #      replacement: ${1}
+  #      action: replace
+  #  ## relabel configs to apply to samples after ingestion.
+  #  ##
+  #  relabelings:
+  #    - sourceLabels: [__meta_kubernetes_pod_node_name]
+  #      separator: ;
+  #      regex: ^(.*)$
+  #      targetLabel: nodename
+  #      replacement: $1
+  #      action: replace
+  #  scheme: ""
+  #  tlsConfig: {}
+
+  ## Bear in mind if you want to collect metrics from a different port
+  ## you will need to configure the new ports on the extraPorts property.
+  additionalEndpoints: []
+  # - port: metrics
+  #   path: /metrics
+  #   interval: 10s
+  #   scrapeTimeout: 10s
+  #   scheme: ""
+  #   tlsConfig: {}
+  #   # metric relabel configs to apply to samples before ingestion.
+  #   #
+  #   metricRelabelings:
+  #     - sourceLabels: [__meta_kubernetes_service_label_cluster]
+  #       targetLabel: cluster
+  #       regex: (.*)
+  #       replacement: ${1}
+  #       action: replace
+  #   # relabel configs to apply to samples after ingestion.
+  #   #
+  #   relabelings:
+  #     - sourceLabels: [__meta_kubernetes_pod_node_name]
+  #       separator: ;
+  #       regex: ^(.*)$
+  #       targetLabel: nodename
+  #       replacement: $1
+  #       action: replace
+
+prometheusRule:
+  enabled: false
+#   namespace: ""
+#   additionalLabels: {}
+#   rules:
+#   - alert: NoOutputBytesProcessed
+#     expr: rate(fluentbit_output_proc_bytes_total[5m]) == 0
+#     annotations:
+#       message: |
+#         Fluent Bit instance {{ $labels.instance }}'s output plugin {{ $labels.name }} has not processed any
+#         bytes for at least 15 minutes.
+#       summary: No Output Bytes Processed
+#     for: 15m
+#     labels:
+#       severity: critical
+
+dashboards:
+  enabled: false
+  labelKey: grafana_dashboard
+  labelValue: 1
+  annotations: {}
+  namespace: ""
+
+lifecycle: {}
+#   preStop:
+#     exec:
+#       command: ["/bin/sh", "-c", "sleep 20"]
+
+livenessProbe:
+  httpGet:
+    path: /
+    port: http
+
+readinessProbe:
+  httpGet:
+    path: /api/v1/health
+    port: http
+
+resources: {}
+#   limits:
+#     cpu: 100m
+#     memory: 128Mi
+#   requests:
+#     cpu: 100m
+#     memory: 128Mi
+
+## only available if kind is Deployment
+ingress:
+  enabled: false
+  ingressClassName: ""
+  annotations: {}
+  #  kubernetes.io/ingress.class: nginx
+  #  kubernetes.io/tls-acme: "true"
+  hosts: []
+  # - host: fluent-bit.example.tld
+  extraHosts: []
+  # - host: fluent-bit-extra.example.tld
+  ## specify extraPort number
+  #   port: 5170
+  tls: []
+  #  - secretName: fluent-bit-example-tld
+  #    hosts:
+  #      - fluent-bit.example.tld
+
+## only available if kind is Deployment
+autoscaling:
+  vpa:
+    enabled: false
+
+    annotations: {}
+
+    # List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory
+    controlledResources: []
+
+    # Define the max allowed resources for the pod
+    maxAllowed: {}
+    # cpu: 200m
+    # memory: 100Mi
+    # Define the min allowed resources for the pod
+    minAllowed: {}
+    # cpu: 200m
+    # memory: 100Mi
+
+    updatePolicy:
+      # Specifies whether recommended updates are applied when a Pod is started and whether recommended updates
+      # are applied during the life of a Pod. Possible values are "Off", "Initial", "Recreate", and "Auto".
+      updateMode: Auto
+
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 3
+  targetCPUUtilizationPercentage: 75
+  #  targetMemoryUtilizationPercentage: 75
+  ## see https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough/#autoscaling-on-multiple-metrics-and-custom-metrics
+  customRules: []
+  #     - type: Pods
+  #       pods:
+  #         metric:
+  #           name: packets-per-second
+  #         target:
+  #           type: AverageValue
+  #           averageValue: 1k
+  ## see https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-configurable-scaling-behavior
+  behavior: {}
+#      scaleDown:
+#        policies:
+#          - type: Pods
+#            value: 4
+#            periodSeconds: 60
+#          - type: Percent
+#            value: 10
+#            periodSeconds: 60
+
+## only available if kind is Deployment
+podDisruptionBudget:
+  enabled: false
+  annotations: {}
+  maxUnavailable: "30%"
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+
+labels: {}
+
+annotations: {}
+
+podAnnotations: {}
+
+podLabels: {}
+
+## How long (in seconds) a pods needs to be stable before progressing the deployment
+##
+minReadySeconds:
+
+## How long (in seconds) a pod may take to exit (useful with lifecycle hooks to ensure lb deregistration is done)
+##
+terminationGracePeriodSeconds:
+
+priorityClassName: ""
+
+env: []
+#  - name: FOO
+#    value: "bar"
+
+# The envWithTpl array below has the same usage as "env", but is using the tpl function to support templatable string.
+# This can be useful when you want to pass dynamic values to the Chart using the helm argument "--set <variable>=<value>"
+# https://helm.sh/docs/howto/charts_tips_and_tricks/#using-the-tpl-function
+envWithTpl: []
+#  - name: FOO_2
+#    value: "{{ .Values.foo2 }}"
+#
+# foo2: bar2
+
+envFrom: []
+
+# This supports either a structured array or a templatable string
+extraContainers: []
+
+# Array mode
+# extraContainers:
+#   - name: do-something
+#     image: busybox
+#     command: ['do', 'something']
+
+# String mode
+# extraContainers: |-
+#   - name: do-something
+#     image: bitnami/kubectl:{{ .Capabilities.KubeVersion.Major }}.{{ .Capabilities.KubeVersion.Minor }}
+#     command: ['kubectl', 'version']
+
+flush: 1
+
+metricsPort: 2020
+
+extraPorts: []
+#   - port: 5170
+#     containerPort: 5170
+#     protocol: TCP
+#     name: tcp
+#     nodePort: 30517
+
+extraVolumes: []
+
+extraVolumeMounts: []
+
+updateStrategy: {}
+#   type: RollingUpdate
+#   rollingUpdate:
+#     maxUnavailable: 1
+
+# Make use of a pre-defined configmap instead of the one templated here
+existingConfigMap: ""
+
+networkPolicy:
+  enabled: false
+#   ingress:
+#     from: []
+
+luaScripts: {}
+
+## https://docs.fluentbit.io/manual/administration/configuring-fluent-bit/classic-mode/configuration-file
+config:
+  service: |
+    [SERVICE]
+        Daemon Off
+        Flush {{ .Values.flush }}
+        Log_Level {{ .Values.logLevel }}
+        Parsers_File /fluent-bit/etc/parsers.conf
+        Parsers_File /fluent-bit/etc/conf/custom_parsers.conf
+        HTTP_Server On
+        HTTP_Listen 0.0.0.0
+        HTTP_Port {{ .Values.metricsPort }}
+        Health_Check On
+
+  ## https://docs.fluentbit.io/manual/pipeline/inputs
+  inputs: |
+    [INPUT]
+        Name tail
+        Path /var/log/containers/*.log
+        multiline.parser docker, cri
+        Tag kube.*
+        Mem_Buf_Limit 5MB
+        Skip_Long_Lines On
+
+    [INPUT]
+        Name systemd
+        Tag host.*
+        Systemd_Filter _SYSTEMD_UNIT=kubelet.service
+        Read_From_Tail On
+
+  ## https://docs.fluentbit.io/manual/pipeline/filters
+  filters: |
+    [FILTER]
+        Name kubernetes
+        Match kube.*
+        Merge_Log On
+        Keep_Log Off
+        K8S-Logging.Parser On
+        K8S-Logging.Exclude On
+
+  ## https://docs.fluentbit.io/manual/pipeline/outputs
+  outputs: |
+    [OUTPUT]
+        Name es
+        Match kube.*
+        Host elasticsearch-master
+        Logstash_Format On
+        Retry_Limit False
+
+    [OUTPUT]
+        Name es
+        Match host.*
+        Host elasticsearch-master
+        Logstash_Format On
+        Logstash_Prefix node
+        Retry_Limit False
+
+  ## https://docs.fluentbit.io/manual/administration/configuring-fluent-bit/classic-mode/upstream-servers
+  ## This configuration is deprecated, please use `extraFiles` instead.
+  upstream: {}
+
+  ## https://docs.fluentbit.io/manual/pipeline/parsers
+  customParsers: |
+    [PARSER]
+        Name docker_no_time
+        Format json
+        Time_Keep Off
+        Time_Key time
+        Time_Format %Y-%m-%dT%H:%M:%S.%L
+
+  # This allows adding more files with arbitrary filenames to /fluent-bit/etc/conf by providing key/value pairs.
+  # The key becomes the filename, the value becomes the file content.
+  extraFiles: {}
+#     upstream.conf: |
+#       [UPSTREAM]
+#           upstream1
+#
+#       [NODE]
+#           name       node-1
+#           host       127.0.0.1
+#           port       43000
+#     example.conf: |
+#       [OUTPUT]
+#           Name example
+#           Match foo.*
+#           Host bar
+
+# The config volume is mounted by default, either to the existingConfigMap value, or the default of "fluent-bit.fullname"
+volumeMounts:
+  - name: config
+    mountPath: /fluent-bit/etc/conf
+
+daemonSetVolumes:
+  - name: varlog
+    hostPath:
+      path: /var/log
+  - name: varlibdockercontainers
+    hostPath:
+      path: /var/lib/docker/containers
+  - name: etcmachineid
+    hostPath:
+      path: /etc/machine-id
+      type: File
+
+daemonSetVolumeMounts:
+  - name: varlog
+    mountPath: /var/log
+  - name: varlibdockercontainers
+    mountPath: /var/lib/docker/containers
+    readOnly: true
+  - name: etcmachineid
+    mountPath: /etc/machine-id
+    readOnly: true
+
+command:
+  - /fluent-bit/bin/fluent-bit
+
+args:
+  - --workdir=/fluent-bit/etc
+  - --config=/fluent-bit/etc/conf/fluent-bit.conf
+
+# This supports either a structured array or a templatable string
+initContainers: []
+
+# Array mode
+# initContainers:
+#   - name: do-something
+#     image: bitnami/kubectl:1.22
+#     command: ['kubectl', 'version']
+
+# String mode
+# initContainers: |-
+#   - name: do-something
+#     image: bitnami/kubectl:{{ .Capabilities.KubeVersion.Major }}.{{ .Capabilities.KubeVersion.Minor }}
+#     command: ['kubectl', 'version']
+
+logLevel: info
+
+hotReload:
+  enabled: false
+  image:
+    repository: ghcr.io/jimmidyson/configmap-reload
+    tag: v0.11.1
+    digest:
+    pullPolicy: IfNotPresent
+  resources: {}

packages/system/monitoring/charts/kube-state-metrics/Chart.yaml

@@ -4,7 +4,7 @@ annotations:
     - name: Chart Source
       url: https://github.com/prometheus-community/helm-charts
 apiVersion: v2
-appVersion: 2.10.1
+appVersion: 2.13.0
 description: Install kube-state-metrics to generate and expose cluster-level metrics
 home: https://github.com/kubernetes/kube-state-metrics/
 keywords:
@@ -23,4 +23,4 @@ name: kube-state-metrics
 sources:
 - https://github.com/kubernetes/kube-state-metrics/
 type: application
-version: 5.15.2
+version: 5.25.1

packages/system/monitoring/charts/kube-state-metrics/templates/_helpers.tpl

@@ -66,7 +66,7 @@ app.kubernetes.io/part-of: {{ template "kube-state-metrics.name" . }}
 app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 {{- end }}
 {{- if .Values.customLabels }}
-{{ toYaml .Values.customLabels }}
+{{ tpl (toYaml .Values.customLabels) . }}
 {{- end }}
 {{- if .Values.releaseLabel }}
 release: {{ .Release.Name }}

packages/system/monitoring/charts/kube-state-metrics/templates/deployment.yaml

@@ -31,11 +31,15 @@ spec:
     metadata:
       labels:
         {{- include "kube-state-metrics.labels" . | indent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       {{- if .Values.podAnnotations }}
       annotations:
-{{ toYaml .Values.podAnnotations | indent 8 }}
+      {{ toYaml .Values.podAnnotations | nindent 8 }}
       {{- end }}
     spec:
+      automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
       hostNetwork: {{ .Values.hostNetwork }}
       serviceAccountName: {{ template "kube-state-metrics.serviceAccountName" . }}
       {{- if .Values.securityContext.enabled }}
@@ -49,10 +53,10 @@ spec:
       {{- toYaml . | nindent 6 }}
       {{- end }}
       containers:
-      {{- $httpPort := ternary 9090 (.Values.service.port | default 8080) .Values.kubeRBACProxy.enabled}}
+      {{- $servicePort := ternary 9090 (.Values.service.port | default 8080) .Values.kubeRBACProxy.enabled}}
       {{- $telemetryPort := ternary 9091 (.Values.selfMonitor.telemetryPort | default 8081) .Values.kubeRBACProxy.enabled}}
       - name: {{ template "kube-state-metrics.name" . }}
-        {{- if .Values.autosharding.enabled }}
+        {{- if  .Values.autosharding.enabled }}
         env:
         - name: POD_NAME
           valueFrom:
@@ -67,7 +71,7 @@ spec:
         {{-  if .Values.extraArgs  }}
         {{- .Values.extraArgs | toYaml | nindent 8 }}
         {{-  end  }}
-        - --port={{ $httpPort }}
+        - --port={{ $servicePort }}
         {{-  if .Values.collectors  }}
         - --resources={{ .Values.collectors | join "," }}
         {{-  end  }}
@@ -115,10 +119,10 @@ spec:
         {{- if .Values.selfMonitor.telemetryPort }}
         - --telemetry-port={{ $telemetryPort }}
         {{- end }}
+        {{- end }}
         {{- if .Values.customResourceState.enabled }}
         - --custom-resource-state-config-file=/etc/customresourcestate/config.yaml
         {{- end }}
-        {{- end }}
         {{- if or (.Values.kubeconfig.enabled) (.Values.customResourceState.enabled) (.Values.volumeMounts) }}
         volumeMounts:
         {{- if .Values.kubeconfig.enabled }}
@@ -146,22 +150,64 @@ spec:
           name: "metrics"
         {{- end }}
         {{- end }}
-        livenessProbe:
+        {{- if .Values.startupProbe.enabled }}
+        startupProbe:
+          failureThreshold: {{ .Values.startupProbe.failureThreshold }}
           httpGet:
+            {{- if .Values.hostNetwork }}
+            host: 127.0.0.1
+            {{- end }}
+            httpHeaders:
+            {{- range $_, $header := .Values.startupProbe.httpGet.httpHeaders }}
+            - name: {{ $header.name }}
+              value: {{ $header.value }}
+            {{- end }}
             path: /healthz
-            port: {{ $httpPort }}
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
-        readinessProbe:
+            port: {{ $servicePort }}
+            scheme: {{ upper .Values.startupProbe.httpGet.scheme }}
+          initialDelaySeconds: {{ .Values.startupProbe.initialDelaySeconds }}
+          periodSeconds: {{ .Values.startupProbe.periodSeconds }}
+          successThreshold: {{ .Values.startupProbe.successThreshold }}
+          timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }}
+        {{- end }}
+        livenessProbe:
+          failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
           httpGet:
-            path: /
-            port: {{ $httpPort }}
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
-        {{- if .Values.resources }}
+            {{- if .Values.hostNetwork }}
+            host: 127.0.0.1
+            {{- end }}
+            httpHeaders:
+            {{- range $_, $header := .Values.livenessProbe.httpGet.httpHeaders }}
+            - name: {{ $header.name }}
+              value: {{ $header.value }}
+            {{- end }}
+            path: /livez
+            port: {{ $servicePort }}
+            scheme: {{ upper .Values.livenessProbe.httpGet.scheme }}
+          initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
+          periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
+          successThreshold: {{ .Values.livenessProbe.successThreshold }}
+          timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
+        readinessProbe:
+          failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
+          httpGet:
+            {{- if .Values.hostNetwork }}
+            host: 127.0.0.1
+            {{- end }}
+            httpHeaders:
+            {{- range $_, $header := .Values.readinessProbe.httpGet.httpHeaders }}
+            - name: {{ $header.name }}
+              value: {{ $header.value }}
+            {{- end }}
+            path: /readyz
+            port: {{ $servicePort }}
+            scheme: {{ upper .Values.readinessProbe.httpGet.scheme }}
+          initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+          periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+          successThreshold: {{ .Values.readinessProbe.successThreshold }}
+          timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
         resources:
 {{ toYaml .Values.resources | indent 10 }}
-{{- end }}
 {{- if .Values.containerSecurityContext }}
         securityContext:
 {{ toYaml .Values.containerSecurityContext | indent 10 }}
@@ -173,7 +219,7 @@ spec:
         {{- .Values.kubeRBACProxy.extraArgs | toYaml | nindent 8 }}
         {{-  end  }}
         - --secure-listen-address=:{{ .Values.service.port | default 8080}}
-        - --upstream=http://127.0.0.1:{{ $httpPort }}/
+        - --upstream=http://127.0.0.1:{{ $servicePort }}/
         - --proxy-endpoints-port=8888
         - --config-file=/etc/kube-rbac-proxy-config/config-file.yaml
         volumeMounts:

packages/system/monitoring/charts/kube-state-metrics/templates/service.yaml

@@ -14,6 +14,10 @@ metadata:
     {{- end }}
 spec:
   type: "{{ .Values.service.type }}"
+  {{- if .Values.service.ipDualStack.enabled }}
+  ipFamilies: {{ toYaml .Values.service.ipDualStack.ipFamilies | nindent 4 }}
+  ipFamilyPolicy: {{ .Values.service.ipDualStack.ipFamilyPolicy }}
+  {{- end }}
   ports:
   - name: "http"
     protocol: TCP

packages/system/monitoring/charts/kube-state-metrics/templates/serviceaccount.yaml

@@ -1,6 +1,7 @@
 {{- if .Values.serviceAccount.create -}}
 apiVersion: v1
 kind: ServiceAccount
+automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
 metadata:
   labels:
     {{- include "kube-state-metrics.labels" . | indent 4 }}
@@ -10,6 +11,8 @@ metadata:
   annotations:
 {{ toYaml .Values.serviceAccount.annotations | indent 4 }}
 {{- end }}
+{{- if or .Values.serviceAccount.imagePullSecrets .Values.global.imagePullSecrets }}
 imagePullSecrets:
   {{- include "kube-state-metrics.imagePullSecrets" (dict "Values" .Values "imagePullSecrets" .Values.serviceAccount.imagePullSecrets) | indent 2 }}
+{{- end }}
 {{- end -}}

packages/system/monitoring/charts/kube-state-metrics/templates/servicemonitor.yaml

@@ -40,79 +40,79 @@ spec:
     {{- end }}
   endpoints:
     - port: http
-    {{- if .Values.prometheus.monitor.interval }}
-      interval: {{ .Values.prometheus.monitor.interval }}
+    {{- if or .Values.prometheus.monitor.http.interval .Values.prometheus.monitor.interval }}
+      interval: {{ .Values.prometheus.monitor.http.interval | default .Values.prometheus.monitor.interval }}
     {{- end }}
-    {{- if .Values.prometheus.monitor.scrapeTimeout }}
-      scrapeTimeout: {{ .Values.prometheus.monitor.scrapeTimeout }}
+    {{- if or .Values.prometheus.monitor.http.scrapeTimeout .Values.prometheus.monitor.scrapeTimeout }}
+      scrapeTimeout: {{ .Values.prometheus.monitor.http.scrapeTimeout | default .Values.prometheus.monitor.scrapeTimeout }}
     {{- end }}
-    {{- if .Values.prometheus.monitor.proxyUrl }}
-      proxyUrl: {{ .Values.prometheus.monitor.proxyUrl}}
+    {{- if or .Values.prometheus.monitor.http.proxyUrl .Values.prometheus.monitor.proxyUrl }}
+      proxyUrl: {{ .Values.prometheus.monitor.http.proxyUrl | default .Values.prometheus.monitor.proxyUrl }}
     {{- end }}
-    {{- if .Values.prometheus.monitor.enableHttp2 }}
-      enableHttp2: {{ .Values.prometheus.monitor.enableHttp2}}
+    {{- if or .Values.prometheus.monitor.http.enableHttp2 .Values.prometheus.monitor.enableHttp2 }}
+      enableHttp2: {{ .Values.prometheus.monitor.http.enableHttp2 | default .Values.prometheus.monitor.enableHttp2 }}
     {{- end }}
-    {{- if .Values.prometheus.monitor.honorLabels }}
+    {{- if or .Values.prometheus.monitor.http.honorLabels .Values.prometheus.monitor.honorLabels }}
       honorLabels: true
     {{- end }}
-    {{- if .Values.prometheus.monitor.metricRelabelings }}
+    {{- if or .Values.prometheus.monitor.http.metricRelabelings .Values.prometheus.monitor.metricRelabelings }}
       metricRelabelings:
-        {{- toYaml .Values.prometheus.monitor.metricRelabelings | nindent 8 }}
+        {{- toYaml (.Values.prometheus.monitor.http.metricRelabelings | default .Values.prometheus.monitor.metricRelabelings) | nindent 8 }}
     {{- end }}
-    {{- if .Values.prometheus.monitor.relabelings }}
+    {{- if or .Values.prometheus.monitor.http.relabelings .Values.prometheus.monitor.relabelings }}
       relabelings:
-        {{- toYaml .Values.prometheus.monitor.relabelings | nindent 8 }}
+        {{- toYaml (.Values.prometheus.monitor.http.relabelings | default .Values.prometheus.monitor.relabelings) | nindent 8 }}
     {{- end }}
-    {{- if .Values.prometheus.monitor.scheme }}
-      scheme: {{ .Values.prometheus.monitor.scheme }}
+    {{- if or .Values.prometheus.monitor.http.scheme .Values.prometheus.monitor.scheme }}
+      scheme: {{ .Values.prometheus.monitor.http.scheme | default .Values.prometheus.monitor.scheme }}
     {{- end }}
-    {{- if .Values.prometheus.monitor.tlsConfig }}
+    {{- if or .Values.prometheus.monitor.http.tlsConfig .Values.prometheus.monitor.tlsConfig }}
       tlsConfig:
-        {{- toYaml .Values.prometheus.monitor.tlsConfig | nindent 8 }}
+        {{- toYaml (.Values.prometheus.monitor.http.tlsConfig | default .Values.prometheus.monitor.tlsConfig) | nindent 8 }}
     {{- end }}
-    {{- if .Values.prometheus.monitor.bearerTokenFile }}
-      bearerTokenFile: {{ .Values.prometheus.monitor.bearerTokenFile }}
+    {{- if or .Values.prometheus.monitor.http.bearerTokenFile .Values.prometheus.monitor.bearerTokenFile }}
+      bearerTokenFile: {{ .Values.prometheus.monitor.http.bearerTokenFile | default .Values.prometheus.monitor.bearerTokenFile }}
     {{- end }}
-    {{- with .Values.prometheus.monitor.bearerTokenSecret }}
+    {{- with (.Values.prometheus.monitor.http.bearerTokenSecret | default .Values.prometheus.monitor.bearerTokenSecret) }}
       bearerTokenSecret:
         {{- toYaml . | nindent 8 }}
     {{- end }}
   {{- if .Values.selfMonitor.enabled }}
     - port: metrics
-    {{- if .Values.prometheus.monitor.interval }}
-      interval: {{ .Values.prometheus.monitor.interval }}
+    {{- if or .Values.prometheus.monitor.metrics.interval .Values.prometheus.monitor.interval }}
+      interval: {{ .Values.prometheus.monitor.metrics.interval | default .Values.prometheus.monitor.interval }}
     {{- end }}
-    {{- if .Values.prometheus.monitor.scrapeTimeout }}
-      scrapeTimeout: {{ .Values.prometheus.monitor.scrapeTimeout }}
+    {{- if or .Values.prometheus.monitor.metrics.scrapeTimeout .Values.prometheus.monitor.scrapeTimeout }}
+      scrapeTimeout: {{ .Values.prometheus.monitor.metrics.scrapeTimeout | default .Values.prometheus.monitor.scrapeTimeout }}
     {{- end }}
-    {{- if .Values.prometheus.monitor.proxyUrl }}
-      proxyUrl: {{ .Values.prometheus.monitor.proxyUrl}}
+    {{- if or .Values.prometheus.monitor.metrics.proxyUrl .Values.prometheus.monitor.proxyUrl }}
+      proxyUrl: {{ .Values.prometheus.monitor.metrics.proxyUrl | default .Values.prometheus.monitor.proxyUrl }}
     {{- end }}
-    {{- if .Values.prometheus.monitor.enableHttp2 }}
-      enableHttp2: {{ .Values.prometheus.monitor.enableHttp2}}
+    {{- if or .Values.prometheus.monitor.metrics.enableHttp2 .Values.prometheus.monitor.enableHttp2 }}
+      enableHttp2: {{ .Values.prometheus.monitor.metrics.enableHttp2 | default .Values.prometheus.monitor.enableHttp2 }}
     {{- end }}
-    {{- if .Values.prometheus.monitor.honorLabels }}
+    {{- if or .Values.prometheus.monitor.metrics.honorLabels .Values.prometheus.monitor.honorLabels }}
       honorLabels: true
     {{- end }}
-    {{- if .Values.prometheus.monitor.metricRelabelings }}
+    {{- if or .Values.prometheus.monitor.metrics.metricRelabelings .Values.prometheus.monitor.metricRelabelings }}
       metricRelabelings:
-        {{- toYaml .Values.prometheus.monitor.metricRelabelings | nindent 8 }}
+        {{- toYaml (.Values.prometheus.monitor.metrics.metricRelabelings | default .Values.prometheus.monitor.metricRelabelings) | nindent 8 }}
     {{- end }}
-    {{- if .Values.prometheus.monitor.relabelings }}
+    {{- if or .Values.prometheus.monitor.metrics.relabelings .Values.prometheus.monitor.relabelings }}
       relabelings:
-        {{- toYaml .Values.prometheus.monitor.relabelings | nindent 8 }}
+        {{- toYaml (.Values.prometheus.monitor.metrics.relabelings | default .Values.prometheus.monitor.relabelings) | nindent 8 }}
     {{- end }}
-    {{- if .Values.prometheus.monitor.scheme }}
-      scheme: {{ .Values.prometheus.monitor.scheme }}
+    {{- if or .Values.prometheus.monitor.metrics.scheme .Values.prometheus.monitor.scheme }}
+      scheme: {{ .Values.prometheus.monitor.metrics.scheme | default .Values.prometheus.monitor.scheme }}
     {{- end }}
-    {{- if .Values.prometheus.monitor.tlsConfig }}
+    {{- if or .Values.prometheus.monitor.metrics.tlsConfig .Values.prometheus.monitor.tlsConfig }}
       tlsConfig:
-        {{- toYaml .Values.prometheus.monitor.tlsConfig | nindent 8 }}
+        {{- toYaml (.Values.prometheus.monitor.metrics.tlsConfig | default .Values.prometheus.monitor.tlsConfig) | nindent 8 }}
     {{- end }}
-    {{- if .Values.prometheus.monitor.bearerTokenFile }}
-      bearerTokenFile: {{ .Values.prometheus.monitor.bearerTokenFile }}
+    {{- if or .Values.prometheus.monitor.metrics.bearerTokenFile .Values.prometheus.monitor.bearerTokenFile }}
+      bearerTokenFile: {{ .Values.prometheus.monitor.metrics.bearerTokenFile | default .Values.prometheus.monitor.bearerTokenFile }}
     {{- end }}
-    {{- with .Values.prometheus.monitor.bearerTokenSecret }}
+    {{- with (.Values.prometheus.monitor.metrics.bearerTokenSecret | default .Values.prometheus.monitor.bearerTokenSecret) }}
       bearerTokenSecret:
         {{- toYaml . | nindent 8 }}
     {{- end }}

packages/system/monitoring/charts/kube-state-metrics/values.yaml

@@ -37,7 +37,10 @@ autosharding:
 
 replicas: 1
 
-# Change the deployment strategy when autosharding is disabled
+# Change the deployment strategy when autosharding is disabled.
+# ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
+# The default is "RollingUpdate" as per Kubernetes defaults.
+# During a release, 'RollingUpdate' can lead to two running instances for a short period of time while 'Recreate' can create a small gap in data.
 # updateStrategy: Recreate
 
 # Number of old history to retain to allow rollback
@@ -49,10 +52,17 @@ revisionHistoryLimit: 10
 # all the possible args can be found here: https://github.com/kubernetes/kube-state-metrics/blob/master/docs/cli-arguments.md
 extraArgs: []
 
+# If false then the user will opt out of automounting API credentials.
+automountServiceAccountToken: true
+
 service:
   port: 8080
   # Default to clusterIP for backward compatibility
   type: ClusterIP
+  ipDualStack:
+    enabled: false
+    ipFamilies: ["IPv6", "IPv4"]
+    ipFamilyPolicy: "PreferDualStack"
   nodePort: 0
   loadBalancerIP: ""
   # Only allow access to the loadBalancerIP from these IPs
@@ -96,7 +106,7 @@ kubeRBACProxy:
   image:
     registry: quay.io
     repository: brancz/kube-rbac-proxy
-    tag: v0.14.0
+    tag: v0.18.0
     sha: ""
     pullPolicy: IfNotPresent
 
@@ -108,7 +118,12 @@ kubeRBACProxy:
   ## Specify security settings for a Container
   ## Allows overrides and additional options compared to (Pod) securityContext
   ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
-  containerSecurityContext: {}
+  containerSecurityContext:
+    readOnlyRootFilesystem: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+      - ALL
 
   resources: {}
     # We usually recommend not to specify default resources and to leave this as a conscious
@@ -142,6 +157,8 @@ serviceAccount:
   # Use case: AWS EKS IAM roles for service accounts
   # ref: https://docs.aws.amazon.com/eks/latest/userguide/specify-service-account-role.html
   annotations: {}
+  # If false then the user will opt out of automounting API credentials.
+  automountServiceAccountToken: true
 
 prometheus:
   monitor:
@@ -153,7 +170,6 @@ prometheus:
     jobLabel: ""
     targetLabels: []
     podTargetLabels: []
-    interval: ""
     ## SampleLimit defines per-scrape limit on number of scraped samples that will be accepted.
     ##
     sampleLimit: 0
@@ -173,24 +189,49 @@ prometheus:
     ## Per-scrape limit on length of labels value that will be accepted for a sample. Only valid in Prometheus versions 2.27.0 and newer.
     ##
     labelValueLengthLimit: 0
-    scrapeTimeout: ""
-    proxyUrl: ""
-    ## Whether to enable HTTP2 for servicemonitor
-    # enableHttp2: false
     selectorOverride: {}
-    honorLabels: false
-    metricRelabelings: []
-    relabelings: []
-    scheme: ""
-    ## File to read bearer token for scraping targets
-    bearerTokenFile: ""
-    ## Secret to mount to read bearer token for scraping targets. The secret needs
-    ## to be in the same namespace as the service monitor and accessible by the
-    ## Prometheus Operator
-    bearerTokenSecret: {}
-      # name: secret-name
-      # key:  key-name
-    tlsConfig: {}
+
+    ## kube-state-metrics endpoint
+    http:
+      interval: ""
+      scrapeTimeout: ""
+      proxyUrl: ""
+      ## Whether to enable HTTP2 for servicemonitor
+      enableHttp2: false
+      honorLabels: false
+      metricRelabelings: []
+      relabelings: []
+      scheme: ""
+      ## File to read bearer token for scraping targets
+      bearerTokenFile: ""
+      ## Secret to mount to read bearer token for scraping targets. The secret needs
+      ## to be in the same namespace as the service monitor and accessible by the
+      ## Prometheus Operator
+      bearerTokenSecret: {}
+        # name: secret-name
+        # key:  key-name
+      tlsConfig: {}
+
+    ## selfMonitor endpoint
+    metrics:
+      interval: ""
+      scrapeTimeout: ""
+      proxyUrl: ""
+      ## Whether to enable HTTP2 for servicemonitor
+      enableHttp2: false
+      honorLabels: false
+      metricRelabelings: []
+      relabelings: []
+      scheme: ""
+      ## File to read bearer token for scraping targets
+      bearerTokenFile: ""
+      ## Secret to mount to read bearer token for scraping targets. The secret needs
+      ## to be in the same namespace as the service monitor and accessible by the
+      ## Prometheus Operator
+      bearerTokenSecret: {}
+        # name: secret-name
+        # key:  key-name
+      tlsConfig: {}
 
 ## Specify if a Pod Security Policy for kube-state-metrics must be created
 ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/
@@ -245,6 +286,7 @@ securityContext:
 ## Allows overrides and additional options compared to (Pod) securityContext
 ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
 containerSecurityContext:
+  readOnlyRootFilesystem: true
   allowPrivilegeEscalation: false
   capabilities:
     drop:
@@ -272,6 +314,9 @@ annotations: {}
 # Annotations to be added to the pod
 podAnnotations: {}
 
+# Labels to be added to the pod
+podLabels: {}
+
 ## Assign a PriorityClassName to pods if set
 # priorityClassName: ""
 
@@ -454,3 +499,44 @@ containers: []
 initContainers: []
   # - name: crd-sidecar
   #   image: kiwigrid/k8s-sidecar:latest
+
+## Settings for startup, liveness and readiness probes
+## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
+##
+
+## Startup probe can optionally be enabled.
+##
+startupProbe:
+  enabled: false
+  failureThreshold: 3
+  httpGet:
+    httpHeaders: []
+    scheme: http
+  initialDelaySeconds: 0
+  periodSeconds: 10
+  successThreshold: 1
+  timeoutSeconds: 5
+
+## Liveness probe
+##
+livenessProbe:
+  failureThreshold: 3
+  httpGet:
+    httpHeaders: []
+    scheme: http
+  initialDelaySeconds: 5
+  periodSeconds: 10
+  successThreshold: 1
+  timeoutSeconds: 5
+
+## Readiness probe
+##
+readinessProbe:
+  failureThreshold: 3
+  httpGet:
+    httpHeaders: []
+    scheme: http
+  initialDelaySeconds: 5
+  periodSeconds: 10
+  successThreshold: 1
+  timeoutSeconds: 5

packages/system/monitoring/charts/metrics-server/CHANGELOG.md

@@ -0,0 +1,149 @@
+# Metrics Server Helm Chart Changelog
+
+> [!NOTE]
+> All notable changes to this project will be documented in this file; the format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+<!--
+### Added - For new features.
+### Changed - For changes in existing functionality.
+### Deprecated - For soon-to-be removed features.
+### Removed - For now removed features.
+### Fixed - For any bug fixes.
+### Security - In case of vulnerabilities.
+-->
+
+## [UNRELEASED]
+
+## [3.12.1] - TBC
+
+### Changed
+
+- Updated the _Metrics Server_ OCI image to [v0.7.1](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.1). ([#1461](https://github.com/kubernetes-sigs/metrics-server/pull/1461)) _@stevehipwell_
+
+## [3.12.0] - 2024-02-07
+
+### Changed
+
+- Updated the _Metrics Server_ OCI image to [v0.7.0](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0). ([#1414](https://github.com/kubernetes-sigs/metrics-server/pull/1414)) [@stevehipwell](https://github.com/stevehipwell)
+- Updated the _addon-resizer_ OCI image to [v1.8.20](https://github.com/kubernetes/autoscaler/releases/tag/addon-resizer-1.8.20). ([#1414](https://github.com/kubernetes-sigs/metrics-server/pull/1414)) [@stevehipwell](https://github.com/stevehipwell)
+
+## [3.11.0] - 2023-08-03
+
+### Added
+
+- Added default _Metrics Server_ resource requests.
+
+### Changed
+
+- Updated the _Metrics Server_ OCI image to [v0.6.4](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.4).
+- Updated the _addon-resizer_ OCI image to [v1.8.19](https://github.com/kubernetes/autoscaler/releases/tag/addon-resizer-1.8.19).
+
+## [3.10.0] - 2023-04-12
+
+### Added
+
+- Added support for running under PodSecurity restricted.
+
+### Fixed
+
+- Fixed `auth-reader` role binding namespace to always use `kube-system`.
+- Fixed addon-resizer configuration.
+- Fixed container port default not having been updated to `10250`.
+
+## [3.9.0] - 2023-03-28
+
+### Added
+
+- Added autoscaling support via the addon-resizer.
+
+### Changed
+
+- Updated the _Metrics Server_ OCI image to [v0.6.3](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3).
+
+### Fixed
+
+- Fixed service labels/annotations.
+
+## [3.8.4] - 2023-03-06
+
+### Changed
+
+- Changed the image registry location to `registry.k8s.io`.
+
+## [3.8.3] - 2022-12-08
+
+### Added
+
+- Added support for topologySpreadConstraints.
+- Always set resource namespaces explicitly.
+- Allow configuring TLS on the APIService.
+- Enabled service monitor relabelling.
+- Added ability to set the scheduler name.
+- Added support for common labels.
+
+### Changed
+
+- Updated the _Metrics Server_ OCI image to [v0.6.2](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2).
+
+## [3.8.2] - 2022-02-23
+
+### Changed
+
+- Changed chart to allow probes to be turned off completely (this is not advised unless you know what you're doing).
+
+## [3.8.1] - 2022-02-09
+
+### Changed
+
+- Updated the _Metrics Server_ OCI image to [v0.6.1](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.1).
+
+## [3.8.0] - 2022-02-08
+
+### Added
+
+- Added support for unauthenticated access to the /metrics endpoint.
+- Added optional _Prometheus Operator_ `ServiceMonitor`.
+
+### Changed
+
+- Updated the _Metrics Server_ OCI image to [v0.6.0](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.0).
+
+## [3.7.0] - 2021-11-18
+
+### Changed
+
+- Updated the _Metrics Server_ OCI image to [v0.5.2](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.2).
+
+## [3.6.0] - 2021-10-18
+
+### Added
+
+- Added new `defaultArgs`` value to enable overriding the default arguments.
+
+### Changed
+
+- Updated the _Metrics Server_ OCI image to [v0.5.1](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.1).
+
+## [3.5.0] - 2021-10-07
+
+### Added
+
+- Added initial Helm chart release from official repo.
+
+<!--
+RELEASE LINKS
+-->
+[UNRELEASED]: https://github.com/kubernetes-sigs/metrics-server/tree/master/charts/metrics-server
+[3.12.1]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.12.1
+[3.12.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.12.0
+[3.11.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.11.0
+[3.10.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.10.0
+[3.9.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.9.0
+[3.8.4]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.8.4
+[3.8.3]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.8.3
+[3.8.2]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.8.2
+[3.8.1]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.8.1
+[3.8.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.8.0
+[3.7.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.7.0
+[3.6.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.6.0
+[3.5.0]: https://github.com/kubernetes-sigs/metrics-server/releases/tag/metrics-server-helm-chart-3.5.0

packages/system/monitoring/charts/metrics-server/Chart.yaml

@@ -1,15 +1,9 @@
 annotations:
   artifacthub.io/changes: |
-    - kind: added
-      description: "Added default Metrics Server resource requests."
     - kind: changed
-      description: "Updated the Metrics Server OCI image to v0.6.3."
-    - kind: changed
-      description: "Updated the addon resizer OCI image to v1.8.19."
-    - kind: changed
-      description: "Changed the default addon resizer nanny resource configuration to match the documented Metrics Server autoscaling values."
+      description: "Updated the _Metrics Server_ OCI image to [v0.7.1](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.1)."
 apiVersion: v2
-appVersion: 0.6.4
+appVersion: 0.7.1
 description: Metrics Server is a scalable, efficient source of container resource
   metrics for Kubernetes built-in autoscaling pipelines.
 home: https://github.com/kubernetes-sigs/metrics-server
@@ -29,4 +23,4 @@ name: metrics-server
 sources:
 - https://github.com/kubernetes-sigs/metrics-server
 type: application
-version: 3.11.0
+version: 3.12.1

packages/system/monitoring/charts/metrics-server/README.md

@@ -2,8 +2,6 @@
 
 [Metrics Server](https://github.com/kubernetes-sigs/metrics-server/) is a scalable, efficient source of container resource metrics for Kubernetes built-in autoscaling pipelines.
 
-<!-- Trigger release -->
-
 ## Installing the Chart
 
 Before you can install the chart you will need to add the `metrics-server` repo to [Helm](https://helm.sh/).
@@ -33,12 +31,12 @@ The following table lists the configurable parameters of the _Metrics Server_ ch
 | `serviceAccount.create`              | If `true`, create a new service account.                                                                                                                                                                                                                         | `true`                                                                         |
 | `serviceAccount.annotations`         | Annotations to add to the service account.                                                                                                                                                                                                                       | `{}`                                                                           |
 | `serviceAccount.name`                | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the full name template.                                                                                                                                  | `nil`                                                                          |
-| `serviceAccount.secrets`             | The list of secrets mountable by this service account. See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets                                                                                                             | `[]`                                                                           |
+| `serviceAccount.secrets`             | The list of secrets mountable by this service account. See <https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets>                                                                                                             | `[]`                                                                           |
 | `rbac.create`                        | If `true`, create the RBAC resources.                                                                                                                                                                                                                            | `true`                                                                         |
 | `rbac.pspEnabled`                    | If `true`, create a pod security policy resource.                                                                                                                                                                                                                | `false`                                                                        |
 | `apiService.create`                  | If `true`, create the `v1beta1.metrics.k8s.io` API service. You typically want this enabled! If you disable API service creation you have to manage it outside of this chart for e.g horizontal pod autoscaling to work with this release.                       | `true`                                                                         |
 | `apiService.annotations`             | Annotations to add to the API service                                                                                                                                                                                                                            | `{}`                                                                           |
-| `apiService.insecureSkipTLSVerify`   | Specifies whether to skip TLS verification                                                                                                                                                                                                                       | `true`                                                                         |
+| `apiService.insecureSkipTLSVerify`   | Specifies whether to skip TLS verification (NOTE: this setting is not a proxy for the `--kubelet-insecure-tls` metrics-server flag)                             | `true`                                          |
 | `apiService.caBundle`                | The PEM encoded CA bundle for TLS verification                                                                                                                                                                                                                   | `""`                                                                           |
 | `commonLabels`                       | Labels to add to each object of the chart.                                                                                                                                                                                                                       | `{}`                                                                           |
 | `podLabels`                          | Labels to add to the pod.                                                                                                                                                                                                                                        | `{}`                                                                           |
@@ -49,10 +47,11 @@ The following table lists the configurable parameters of the _Metrics Server_ ch
 | `containerPort`                      | port for the _metrics-server_ container.                                                                                                                                                                                                                         | `10250`                                                                        |
 | `hostNetwork.enabled`                | If `true`, start _metric-server_ in hostNetwork mode. You would require this enabled if you use alternate overlay networking for pods and API server unable to communicate with metrics-server. As an example, this is required if you use Weave network on EKS. | `false`                                                                        |
 | `replicas`                           | Number of replicas to run.                                                                                                                                                                                                                                       | `1`                                                                            |
+| `revisionHistoryLimit`               | Number of revisions to keep.                                                                                                                                                                                                                                     | `nil`                                                                           |
 | `updateStrategy`                     | Customise the default update strategy.                                                                                                                                                                                                                           | `{}`                                                                           |
 | `podDisruptionBudget.enabled`        | If `true`, create `PodDisruptionBudget` resource.                                                                                                                                                                                                                | `{}`                                                                           |
-| `podDisruptionBudget.minAvailable`   | Set the `PodDisruptionBugdet` minimum available pods.                                                                                                                                                                                                            | `nil`                                                                          |
-| `podDisruptionBudget.maxUnavailable` | Set the `PodDisruptionBugdet` maximum unavailable pods.                                                                                                                                                                                                          | `nil`                                                                          |
+| `podDisruptionBudget.minAvailable`   | Set the `PodDisruptionBudget` minimum available pods.                                                                                                                                                                                                            | `nil`                                                                          |
+| `podDisruptionBudget.maxUnavailable` | Set the `PodDisruptionBudget` maximum unavailable pods.                                                                                                                                                                                                          | `nil`                                                                          |
 | `defaultArgs`                        | Default arguments to pass to the _metrics-server_ command.                                                                                                                                                                                                       | See _values.yaml_                                                              |
 | `args`                               | Additional arguments to pass to the _metrics-server_ command.                                                                                                                                                                                                    | `[]`                                                                           |
 | `livenessProbe`                      | Liveness probe.                                                                                                                                                                                                                                                  | See _values.yaml_                                                              |
@@ -62,6 +61,7 @@ The following table lists the configurable parameters of the _Metrics Server_ ch
 | `service.annotations`                | Annotations to add to the service.                                                                                                                                                                                                                               | `{}`                                                                           |
 | `service.labels`                     | Labels to add to the service.                                                                                                                                                                                                                                    | `{}`                                                                           |
 | `addonResizer.enabled`               | If `true`, run the addon-resizer as a sidecar to automatically scale resource requests with cluster size.                                                                                                                                                        | `false`                                                                        |
+| `addonResizer.securityContext`       | Security context for the _metrics_server_container.       |                                                                                                                                             _See values.yaml |
 | `addonResizer.image.repository`      | addon-resizer image repository                                                                                                                                                                                                                                   | `registry.k8s.io/autoscaling/addon-resizer`                                    |
 | `addonResizer.image.tag`             | addon-resizer image tag                                                                                                                                                                                                                                          | `1.8.19`                                                                       |
 | `addonResizer.resources`             | Resource requests and limits for the _nanny_ container.                                                                                                                                                                                                          | `{ requests: { cpu: 40m, memory: 25Mi }, limits: { cpu: 40m, memory: 25Mi } }` |
@@ -79,7 +79,7 @@ The following table lists the configurable parameters of the _Metrics Server_ ch
 | `serviceMonitor.relabelings`         | _Prometheus_ relabeling.                                                                                                                                                                                                                                         | `[]`                                                                           |
 | `serviceMonitor.interval`            | _Prometheus_ scrape frequency.                                                                                                                                                                                                                                   | `1m`                                                                           |
 | `serviceMonitor.scrapeTimeout`       | _Prometheus_ scrape timeout.                                                                                                                                                                                                                                     | `10s`                                                                          |
-| `resources`                          | Resource requests and limits for the _metrics-server_ container. See https://github.com/kubernetes-sigs/metrics-server#scaling                                                                                                                                   | `{ requests: { cpu: 100m, memory: 200Mi }}`                                    |
+| `resources`                          | Resource requests and limits for the _metrics-server_ container. See <https://github.com/kubernetes-sigs/metrics-server#scaling>                                                                                                                                   | `{ requests: { cpu: 100m, memory: 200Mi }}`                                    |
 | `extraVolumeMounts`                  | Additional volume mounts for the _metrics-server_ container.                                                                                                                                                                                                     | `[]`                                                                           |
 | `extraVolumes`                       | Additional volumes for the pod.                                                                                                                                                                                                                                  | `[]`                                                                           |
 | `nodeSelector`                       | Node labels for pod assignment.                                                                                                                                                                                                                                  | `{}`                                                                           |
@@ -88,3 +88,5 @@ The following table lists the configurable parameters of the _Metrics Server_ ch
 | `topologySpreadConstraints`          | Pod Topology Spread Constraints.                                                                                                                                                                                                                                 | `[]`                                                                           |
 | `deploymentAnnotations`              | Annotations to add to the deployment.                                                                                                                                                                                                                            | `{}`                                                                           |
 | `schedulerName`                      | scheduler to set to the deployment.                                                                                                                                                                                                                              | `""`                                                                           |
+| `dnsConfig`                          | Set the dns configuration options for the deployment.                                                                                                                                                                                                            | `{}`                                                                           |
+| `tmpVolume`                          | Volume to be mounted in Pods for temporary files.                                                                                                                                                                                                                | `{"emptyDir":{}}`                                                              |

packages/system/monitoring/charts/metrics-server/RELEASE.md

@@ -0,0 +1 @@
+

packages/system/monitoring/charts/metrics-server/templates/deployment.yaml

@@ -11,6 +11,9 @@ metadata:
   {{- end }}
 spec:
   replicas: {{ .Values.replicas }}
+  {{- if or (kindIs "float64" .Values.revisionHistoryLimit) (kindIs "int64" .Values.revisionHistoryLimit) }}
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit | int64 }}
+  {{- end }}
   {{- with .Values.updateStrategy }}
   strategy:
     {{- toYaml . | nindent 4 }}
@@ -46,6 +49,10 @@ spec:
       {{- if .Values.hostNetwork.enabled }}
       hostNetwork: true
       {{- end }}
+      {{- with .Values.dnsConfig }}
+      dnsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: metrics-server
           {{- with .Values.securityContext }}
@@ -89,6 +96,10 @@ spec:
           {{- end }}
         {{- if .Values.addonResizer.enabled }}
         - name: metrics-server-nanny
+          {{- with .Values.addonResizer.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           image: {{ include "metrics-server.addonResizer.image" . }}
           env:
             - name: MY_POD_NAME
@@ -119,7 +130,7 @@ spec:
         {{- end }}
       volumes:
         - name: tmp
-          emptyDir: {}
+          {{- toYaml .Values.tmpVolume | nindent 10 }}
       {{- if .Values.addonResizer.enabled }}
         - name: nanny-config-volume
           configMap:

packages/system/monitoring/charts/metrics-server/values.yaml

@@ -76,6 +76,8 @@ hostNetwork:
 
 replicas: 1
 
+revisionHistoryLimit:
+
 updateStrategy: {}
 #   type: RollingUpdate
 #   rollingUpdate:
@@ -127,7 +129,17 @@ addonResizer:
   enabled: false
   image:
     repository: registry.k8s.io/autoscaling/addon-resizer
-    tag: 1.8.19
+    tag: 1.8.20
+  securityContext:
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    runAsUser: 1000
+    seccompProfile:
+      type: RuntimeDefault
+    capabilities:
+      drop:
+        - ALL
   resources:
     requests:
       cpu: 40m
@@ -176,7 +188,12 @@ affinity: {}
 
 topologySpreadConstraints: []
 
+dnsConfig: {}
+
 # Annotations to add to the deployment
 deploymentAnnotations: {}
 
 schedulerName: ""
+
+tmpVolume:
+  emptyDir: {}

packages/system/monitoring/charts/prometheus-node-exporter/Chart.yaml

@@ -4,7 +4,7 @@ annotations:
     - name: Chart Source
       url: https://github.com/prometheus-community/helm-charts
 apiVersion: v2
-appVersion: 1.7.0
+appVersion: 1.8.2
 description: A Helm chart for prometheus node-exporter
 home: https://github.com/prometheus/node_exporter/
 keywords:
@@ -22,4 +22,4 @@ name: prometheus-node-exporter
 sources:
 - https://github.com/prometheus/node_exporter/
 type: application
-version: 4.24.0
+version: 4.39.0

packages/system/monitoring/charts/prometheus-node-exporter/ci/common-labels-values.yaml

@@ -0,0 +1,4 @@
+---
+commonLabels:
+  foo: bar
+  baz: '{{ include "prometheus-node-exporter.fullname" . }}'

packages/system/monitoring/charts/prometheus-node-exporter/ci/default-values.yaml

@@ -0,0 +1 @@
+## Default values test case

packages/system/monitoring/charts/prometheus-node-exporter/ci/pod-labels-values.yaml

@@ -0,0 +1,4 @@
+---
+podLabels:
+  foo: bar
+  baz: '{{ .Chart.AppVersion }}'

packages/system/monitoring/charts/prometheus-node-exporter/ci/service-labels-values.yaml

@@ -0,0 +1,5 @@
+---
+service:
+  labels:
+    foo: bar
+    baz: quux

packages/system/monitoring/charts/prometheus-node-exporter/ci/serviceport-values.yaml

@@ -0,0 +1,3 @@
+---
+service:
+  servicePort: 80

packages/system/monitoring/charts/prometheus-node-exporter/templates/_helpers.tpl

@@ -43,8 +43,8 @@ app.kubernetes.io/part-of: {{ include "prometheus-node-exporter.name" . }}
 {{- with .Chart.AppVersion }}
 app.kubernetes.io/version: {{ . | quote }}
 {{- end }}
-{{- with .Values.podLabels }}
-{{ toYaml . }}
+{{- with .Values.commonLabels }}
+{{ tpl (toYaml .) $ }}
 {{- end }}
 {{- if .Values.releaseLabel }}
 release: {{ .Release.Name }}
@@ -183,3 +183,20 @@ labelNameLengthLimit: {{ . }}
 labelValueLengthLimit: {{ . }}
 {{- end }}
 {{- end }}
+
+{{/* Sets sidecar volumeMounts */}}
+{{- define "prometheus-node-exporter.sidecarVolumeMounts" -}}
+{{- range $_, $mount := $.Values.sidecarVolumeMount }}
+- name: {{ $mount.name }}
+  mountPath: {{ $mount.mountPath }}
+  readOnly: {{ $mount.readOnly }}
+{{- end }}
+{{- range $_, $mount := $.Values.sidecarHostVolumeMounts }}
+- name: {{ $mount.name }}
+  mountPath: {{ $mount.mountPath }}
+  readOnly: {{ $mount.readOnly }}
+{{- if $mount.mountPropagation }}
+  mountPropagation: {{ $mount.mountPropagation }}
+{{- end }}
+{{- end }}
+{{- end }}

packages/system/monitoring/charts/prometheus-node-exporter/templates/daemonset.yaml

@@ -26,6 +26,9 @@ spec:
       {{- end }}
       labels:
         {{- include "prometheus-node-exporter.labels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- tpl (toYaml .) $ | nindent 8 }}
+        {{- end }}
     spec:
       automountServiceAccountToken: {{ ternary true false (or .Values.serviceAccount.automountServiceAccountToken .Values.kubeRBACProxy.enabled) }}
       {{- with .Values.securityContext }}
@@ -40,8 +43,11 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       serviceAccountName: {{ include "prometheus-node-exporter.serviceAccountName" . }}
+      {{- with .Values.terminationGracePeriodSeconds }}
+      terminationGracePeriodSeconds: {{ . }}
+      {{- end }}
       containers:
-        {{- $servicePort := ternary 8100 .Values.service.port .Values.kubeRBACProxy.enabled }}
+        {{- $servicePort := ternary .Values.kubeRBACProxy.port .Values.service.port .Values.kubeRBACProxy.enabled }}
         - name: node-exporter
           image: {{ include "prometheus-node-exporter.image" . }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
@@ -50,7 +56,7 @@ spec:
             - --path.sysfs=/host/sys
             {{- if .Values.hostRootFsMount.enabled }}
             - --path.rootfs=/host/root
-            {{- if semverCompare ">=1.4.0" (default .Chart.AppVersion .Values.image.tag) }}
+            {{- if semverCompare ">=1.4.0-0" (coalesce .Values.version .Values.image.tag .Chart.AppVersion) }}
             - --path.udev.data=/host/root/run/udev/data
             {{- end }}
             {{- end }}
@@ -124,12 +130,24 @@ spec:
           resources:
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- if .Values.terminationMessageParams.enabled }}
+          {{- with .Values.terminationMessageParams }}
+          terminationMessagePath: {{ .terminationMessagePath }}
+          terminationMessagePolicy: {{ .terminationMessagePolicy }}
+          {{- end }}
+          {{- end }}
           volumeMounts:
             - name: proc
               mountPath: /host/proc
+              {{- with .Values.hostProcFsMount.mountPropagation }}
+              mountPropagation: {{ . }}
+              {{- end }}
               readOnly:  true
             - name: sys
               mountPath: /host/sys
+              {{- with .Values.hostSysFsMount.mountPropagation }}
+              mountPropagation: {{ . }}
+              {{- end }}
               readOnly: true
             {{- if .Values.hostRootFsMount.enabled }}
             - name: root
@@ -160,24 +178,10 @@ spec:
             - name: {{ .name }}
               mountPath: {{ .mountPath }}
             {{- end }}
-        {{- with .Values.sidecars }}
-        {{- toYaml . | nindent 8 }}
-          {{- if or $.Values.sidecarVolumeMount $.Values.sidecarHostVolumeMounts }}
-          volumeMounts:
-            {{- range $_, $mount := $.Values.sidecarVolumeMount }}
-            - name: {{ $mount.name }}
-              mountPath: {{ $mount.mountPath }}
-              readOnly: {{ $mount.readOnly }}
-            {{- end }}
-            {{- range $_, $mount := $.Values.sidecarHostVolumeMounts }}
-            - name: {{ $mount.name }}
-              mountPath: {{ $mount.mountPath }}
-              readOnly: {{ $mount.readOnly }}
-            {{- if $mount.mountPropagation }}
-              mountPropagation: {{ $mount.mountPropagation }}
-            {{- end }}
-            {{- end }}
-          {{- end }}
+        {{- range .Values.sidecars }}
+          {{- $overwrites := dict "volumeMounts" (concat (include "prometheus-node-exporter.sidecarVolumeMounts" $ | fromYamlArray) (.volumeMounts | default list) | default list) }}
+          {{- $defaults := dict "image" (include "prometheus-node-exporter.image" $) "securityContext" $.Values.containerSecurityContext "imagePullPolicy" $.Values.image.pullPolicy }}
+        - {{- toYaml (merge $overwrites . $defaults) | nindent 10 }}
         {{- end }}
         {{-  if .Values.kubeRBACProxy.enabled  }}
         - name: kube-rbac-proxy
@@ -187,7 +191,7 @@ spec:
             {{-  end  }}
             - --secure-listen-address=:{{ .Values.service.port}}
             - --upstream=http://127.0.0.1:{{ $servicePort }}/
-            - --proxy-endpoints-port=8888
+            - --proxy-endpoints-port={{ .Values.kubeRBACProxy.proxyEndpointsPort }}
             - --config-file=/etc/kube-rbac-proxy-config/config-file.yaml
           volumeMounts:
             - name: kube-rbac-proxy-config
@@ -200,19 +204,38 @@ spec:
           {{- end }}
           ports:
             - containerPort: {{ .Values.service.port}}
-              name: "http"
-            - containerPort: 8888
+              name: {{ .Values.kubeRBACProxy.portName }}
+              {{- if .Values.kubeRBACProxy.enableHostPort }}
+              hostPort: {{ .Values.service.port }}
+              {{- end }}
+            - containerPort: {{ .Values.kubeRBACProxy.proxyEndpointsPort }}
+              {{- if .Values.kubeRBACProxy.enableProxyEndpointsHostPort }}
+              hostPort: {{ .Values.kubeRBACProxy.proxyEndpointsPort }}
+              {{- end }}
               name: "http-healthz"
           readinessProbe:
             httpGet:
               scheme: HTTPS
-              port: 8888
+              port: {{ .Values.kubeRBACProxy.proxyEndpointsPort }}
               path: healthz
             initialDelaySeconds: 5
             timeoutSeconds: 5
           {{- if .Values.kubeRBACProxy.resources }}
           resources:
-          {{ toYaml .Values.kubeRBACProxy.resources | nindent 12 }}
+          {{- toYaml .Values.kubeRBACProxy.resources | nindent 12 }}
+          {{- end }}
+          {{- if .Values.terminationMessageParams.enabled }}
+          {{- with .Values.terminationMessageParams }}
+          terminationMessagePath: {{ .terminationMessagePath }}
+          terminationMessagePolicy: {{ .terminationMessagePolicy }}
+          {{- end }}
+          {{- end }}
+          {{- with .Values.kubeRBACProxy.env }}
+          env:
+            {{- range $key, $value := $.Values.kubeRBACProxy.env }}
+            - name: {{ $key }}
+              value: {{ $value | quote }}
+            {{- end }}
           {{- end }}
           {{- if .Values.kubeRBACProxy.containerSecurityContext }}
           securityContext:
@@ -225,6 +248,7 @@ spec:
       {{- end }}
       hostNetwork: {{ .Values.hostNetwork }}
       hostPID: {{ .Values.hostPID }}
+      hostIPC: {{ .Values.hostIPC }}
       {{- with .Values.affinity }}
       affinity:
         {{- toYaml . | nindent 8 }}
@@ -237,6 +261,9 @@ spec:
       nodeSelector:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.restartPolicy }}
+      restartPolicy: {{ . }}
+      {{- end }}
       {{- with .Values.tolerations }}
       tolerations:
         {{- toYaml . | nindent 8 }}
@@ -257,6 +284,9 @@ spec:
         - name: {{ $mount.name }}
           hostPath:
             path: {{ $mount.hostPath }}
+            {{- with $mount.type }}
+            type: {{ . }}
+            {{- end }}
         {{- end }}
         {{- range $_, $mount := .Values.sidecarVolumeMount }}
         - name: {{ $mount.name }}

packages/system/monitoring/charts/prometheus-node-exporter/templates/service.yaml

@@ -6,6 +6,9 @@ metadata:
   namespace: {{ include "prometheus-node-exporter.namespace" . }}
   labels:
     {{- include "prometheus-node-exporter.labels" $ | nindent 4 }}
+    {{- with .Values.service.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
   {{- with .Values.service.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
@@ -14,10 +17,16 @@ spec:
 {{- if .Values.service.ipDualStack.enabled }}
   ipFamilies: {{ toYaml .Values.service.ipDualStack.ipFamilies | nindent 4 }}
   ipFamilyPolicy: {{ .Values.service.ipDualStack.ipFamilyPolicy }}
+{{- end }}
+{{- if .Values.service.externalTrafficPolicy }}
+  externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy }}
 {{- end }}
   type: {{ .Values.service.type }}
+{{- if and (eq .Values.service.type "ClusterIP") .Values.service.clusterIP }}
+  clusterIP: "{{ .Values.service.clusterIP }}"
+{{- end }}
   ports:
-    - port: {{ .Values.service.port }}
+    - port: {{ .Values.service.servicePort | default .Values.service.port }}
       {{- if ( and (eq .Values.service.type "NodePort" ) (not (empty .Values.service.nodePort)) ) }}
       nodePort: {{ .Values.service.nodePort }}
       {{- end }}

packages/system/monitoring/charts/prometheus-node-exporter/templates/serviceaccount.yaml

@@ -10,6 +10,7 @@ metadata:
   annotations:
     {{- toYaml . | nindent 4 }}
   {{- end }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
 {{- if or .Values.serviceAccount.imagePullSecrets .Values.global.imagePullSecrets }}
 imagePullSecrets:
   {{- include "prometheus-node-exporter.imagePullSecrets" (dict "Values" .Values "imagePullSecrets" .Values.serviceAccount.imagePullSecrets) | indent 2 }}

packages/system/monitoring/charts/prometheus-node-exporter/values.yaml

@@ -39,14 +39,17 @@ global:
 # The requests are served through the same service but requests are HTTPS.
 kubeRBACProxy:
   enabled: false
+  ## Set environment variables as name/value pairs
+  env: {}
+    # VARIABLE: value
   image:
     registry: quay.io
     repository: brancz/kube-rbac-proxy
-    tag: v0.15.0
+    tag: v0.18.0
     sha: ""
     pullPolicy: IfNotPresent
 
-  # List of additional cli arguments to configure kube-rbac-prxy
+  # List of additional cli arguments to configure kube-rbac-proxy
   # for example: --tls-cipher-suites, --log-file, etc.
   # all the possible args can be found here: https://github.com/brancz/kube-rbac-proxy#usage
   extraArgs: []
@@ -56,6 +59,19 @@ kubeRBACProxy:
   ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
   containerSecurityContext: {}
 
+  # Specify the port used for the Node exporter container (upstream port)
+  port: 8100
+  # Specify the name of the container port
+  portName: http
+  # Configure a hostPort. If true, hostPort will be enabled in the container and set to service.port.
+  enableHostPort: false
+
+  # Configure Proxy Endpoints Port
+  # This is the port being probed for readiness
+  proxyEndpointsPort: 8888
+  # Configure a hostPort. If true, hostPort will be enabled in the container and set to proxyEndpointsPort.
+  enableProxyEndpointsHostPort: false
+
   resources: {}
     # We usually recommend not to specify default resources and to leave this as a conscious
     # choice for the user. This also increases chances charts run on environments with little
@@ -64,25 +80,51 @@ kubeRBACProxy:
     # limits:
     #  cpu: 100m
     #  memory: 64Mi
-  # requests:
-  #  cpu: 10m
-  #  memory: 32Mi
+    # requests:
+    #  cpu: 10m
+    #  memory: 32Mi
 
+## Service configuration
 service:
+  ## Creating a service is enabled by default
   enabled: true
+
+  ## Service type
   type: ClusterIP
+  ## IP address for type ClusterIP
+  clusterIP: ""
+  ## Default service port. Sets the port of the exposed container as well (NE or kubeRBACProxy).
+  ## Use "servicePort" below if changing the service port only is desired.
   port: 9100
+  ## Service port. Use this field if you wish to set a different service port
+  ## without changing the container port ("port" above).
+  servicePort: ""
+  ## Targeted port in the pod. Must refer to an open container port ("port" or "portName").
+  ## (IntOrString)
   targetPort: 9100
-  nodePort:
+  ## Name of the service port. Sets the port name of the main container (NE) as well.
   portName: metrics
+  ## Port number for service type NodePort
+  nodePort: null
+
+  ## If true, node exporter will listen on all interfaces
   listenOnAllInterfaces: true
+
+  ## Additional annotations and labels for the service
   annotations:
     prometheus.io/scrape: "true"
+  labels: {}
+
+  ## Dual stack settings for the service
+  ## https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
   ipDualStack:
     enabled: false
     ipFamilies: ["IPv6", "IPv4"]
     ipFamilyPolicy: "PreferDualStack"
 
+  ## External traffic policy setting (Cluster, Local)
+  externalTrafficPolicy: ""
+
 # Set a NetworkPolicy with:
 # ingress only on service.port
 # no egress permitted
@@ -259,6 +301,10 @@ resources: {}
   #   cpu: 100m
   #   memory: 30Mi
 
+# Specify the container restart policy passed to the Node Export container
+# Possible Values: Always (default)|OnFailure|Never
+restartPolicy: null
+
 serviceAccount:
   # Specifies whether a ServiceAccount should be created
   create: true
@@ -300,6 +346,9 @@ hostNetwork: true
 # Share the host process ID namespace
 hostPID: true
 
+# Share the host ipc namespace
+hostIPC: false
+
 # Mount the node's root file system (/) at /host/root in the container
 hostRootFsMount:
   enabled: true
@@ -310,6 +359,16 @@ hostRootFsMount:
   # https://kubernetes.io/docs/concepts/storage/volumes/#mount-propagation
   mountPropagation: HostToContainer
 
+# Mount the node's proc file system (/proc) at /host/proc in the container
+hostProcFsMount:
+  # Possible values are None, HostToContainer, and Bidirectional
+  mountPropagation: ""
+
+# Mount the node's sys file system (/sys) at /host/sys in the container
+hostSysFsMount:
+  # Possible values are None, HostToContainer, and Bidirectional
+  mountPropagation: ""
+
 ## Assign a group of affinity scheduling rules
 ##
 affinity: {}
@@ -327,9 +386,12 @@ podAnnotations:
   # Fix for very slow GKE cluster upgrades
   cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
 
-# Extra labels to be added to node exporter pods
+# Extra labels to add to node exporter pods (can be templated)
 podLabels: {}
 
+## Extra labels to attach to all resources (can be templated)
+commonLabels: {}
+
 # Annotations to be added to node exporter daemonset
 daemonsetAnnotations: {}
 
@@ -354,10 +416,23 @@ nodeSelector:
   kubernetes.io/os: linux
   #  kubernetes.io/arch: amd64
 
+# Specify grace period for graceful termination of pods. Defaults to 30 if null or not specified
+terminationGracePeriodSeconds: null
+
 tolerations:
   - effect: NoSchedule
     operator: Exists
 
+# Enable or disable container termination message settings
+# https://kubernetes.io/docs/tasks/debug/debug-application/determine-reason-pod-failure/
+terminationMessageParams:
+  enabled: false
+  # If enabled, specify the path for termination messages
+  terminationMessagePath: /dev/termination-log
+  # If enabled, specify the policy for termination messages
+  terminationMessagePolicy: File
+
+
 ## Assign a PriorityClassName to pods if set
 # priorityClassName: ""
 
@@ -372,6 +447,8 @@ extraArgs: []
 extraHostVolumeMounts: []
 #  - name: <mountName>
 #    hostPath: <hostPath>
+#    https://kubernetes.io/docs/concepts/storage/volumes/#hostpath-volume-types
+#    type: "" (Default)|DirectoryOrCreate|Directory|FileOrCreate|File|Socket|CharDevice|BlockDevice
 #    mountPath: <mountPath>
 #    readOnly: true|false
 #    mountPropagation: None|HostToContainer|Bidirectional
@@ -388,18 +465,21 @@ secrets: []
 ##
 namespaceOverride: ""
 
-## Additional containers for export metrics to text file
+## Additional containers for export metrics to text file; fields image,imagePullPolicy,securityContext take default value from main container
 ##
 sidecars: []
-##  - name: nvidia-dcgm-exporter
-##    image: nvidia/dcgm-exporter:1.4.3
+#  - name: nvidia-dcgm-exporter
+#    image: nvidia/dcgm-exporter:1.4.3
+#    volumeMounts:
+#     - name: tmp
+#       mountPath: /tmp
 
 ## Volume for sidecar containers
 ##
 sidecarVolumeMount: []
-##  - name: collector-textfiles
-##    mountPath: /run/prometheus
-##    readOnly: false
+#  - name: collector-textfiles
+#    mountPath: /run/prometheus
+#    readOnly: false
 
 ## Additional mounts from the host to sidecar containers
 ##
@@ -478,3 +558,6 @@ extraManifests: []
   #     name: prometheus-extra
   #   data:
   #     extra-data: "value"
+
+# Override version of app, required if image.tag is defined and does not follow semver
+version: ""

packages/system/monitoring/values.yaml

@@ -11,3 +11,54 @@ metrics-server:
   
   serviceMonitor:
     enabled: true
+
+  victoria-logs-single:
+    server:
+      persistentVolume:
+        enabled: true
+        size: 10Gi
+
+fluent-bit:
+  daemonSetVolumes:
+    - name: varlog
+      hostPath:
+        path: /var/log
+    - name: varlibdockercontainers
+      hostPath:
+        path: /var/lib/docker/containers
+
+  daemonSetVolumeMounts:
+    - name: varlog
+      mountPath: /var/log
+    - name: varlibdockercontainers
+      mountPath: /var/lib/docker/containers
+      readOnly: true
+
+  config:
+    outputs: |
+      [OUTPUT]
+          Name http
+          Match kube.*
+          Host vlogs-generic.tenant-root.svc
+          port 9428
+          compress gzip
+          uri /insert/jsonline?_stream_fields=stream,kubernetes_pod_name,kubernetes_container_name,kubernetes_namespace_name&_msg_field=log&_time_field=date
+          format json_lines
+          json_date_format iso8601
+          header AccountID 0
+          header ProjectID 0
+    filters: |
+      [FILTER]
+          Name kubernetes
+          Match kube.*
+          Merge_Log On
+          Keep_Log On
+          K8S-Logging.Parser On
+          K8S-Logging.Exclude On
+      [FILTER]
+          Name                nest
+          Match               *
+          Wildcard            pod_name
+          Operation lift
+          Nested_under kubernetes
+          Add_prefix   kubernetes_

packages/system/victoria-metrics-operator/Makefile

@@ -13,4 +13,4 @@ update:
 	helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
 	helm repo update prometheus-community
 	helm pull prometheus-community/prometheus-operator-crds --untar --untardir charts
-	rm -f -- `find charts/prometheus-operator-crds/templates -maxdepth 1 -mindepth 1 | grep -v 'servicemonitor\|podmonitor\|prometheusrule\|probe'`
+	rm -f -- `find charts/prometheus-operator-crds/charts/crds/templates -maxdepth 1 -mindepth 1 | grep -v 'servicemonitor\|podmonitor\|prometheusrule\|probe'`

packages/system/victoria-metrics-operator/charts/prometheus-operator-crds/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: crds
+  repository: ""
+  version: 0.0.0
+digest: sha256:aeada3fbffa2565a325406ad014001fd2685f7c0c9cfc1167da4f10c75a1bd65
+generated: "2024-08-21T17:23:58.103648765Z"

packages/system/victoria-metrics-operator/charts/prometheus-operator-crds/Chart.yaml

@@ -10,7 +10,11 @@ annotations:
     - name: QuentinBisson
       email: quentin.bisson@gmail.com
 apiVersion: v2
-appVersion: 0.67.0
+appVersion: v0.76.0
+dependencies:
+- name: crds
+  repository: ""
+  version: 0.0.0
 description: 'A Helm chart that collects custom resource definitions (CRDs) from the
   Prometheus Operator, allowing for seamless integration with GitOps tools '
 icon: https://raw.githubusercontent.com/prometheus/prometheus.github.io/master/assets/prometheus_logo-cb55bb5c346.png
@@ -31,4 +35,4 @@ name: prometheus-operator-crds
 sources:
 - https://github.com/prometheus-community/helm-charts
 type: application
-version: 5.1.0
+version: 14.0.0

packages/system/victoria-metrics-operator/charts/prometheus-operator-crds/README.md

@@ -48,6 +48,12 @@ helm upgrade [RELEASE_NAME] [CHART] --install
 
 _See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documentation._
 
+## Upgrading to v6.0.0
+
+The upgraded chart now the following changes:
+
+- `annotations` value has moved to `crds.annotations`
+
 ## Configuring
 
 See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing). To see all configurable options with detailed comments, visit the chart's [values.yaml](./values.yaml), or run these configuration commands:

packages/system/victoria-metrics-operator/charts/prometheus-operator-crds/charts/crds/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+name: crds
+version: 0.0.0

packages/system/victoria-metrics-operator/charts/prometheus-operator-crds/charts/crds/templates/crd-prometheusrules.yaml

@@ -1,4 +1,4 @@
-# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.67.0/example/prometheus-operator-crd/monitoring.coreos.com_prometheusrules.yaml
+# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.76.0/example/prometheus-operator-crd/monitoring.coreos.com_prometheusrules.yaml
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
@@ -7,8 +7,8 @@ metadata:
 {{- with .Values.annotations }}
 {{- toYaml . | nindent 4 }}
 {{- end }}
-    controller-gen.kubebuilder.io/version: v0.11.1
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.15.0
+    operator.prometheus.io/version: 0.76.0
   name: prometheusrules.monitoring.coreos.com
 spec:
   group: monitoring.coreos.com
@@ -26,18 +26,26 @@ spec:
   - name: v1
     schema:
       openAPIV3Schema:
-        description: PrometheusRule defines recording and alerting rules for a Prometheus
-          instance
+        description: |-
+          The `PrometheusRule` custom resource definition (CRD) defines [alerting](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/) and [recording](https://prometheus.io/docs/prometheus/latest/configuration/recording_rules/) rules to be evaluated by `Prometheus` or `ThanosRuler` objects.
+
+
+          `Prometheus` and `ThanosRuler` objects select `PrometheusRule` objects using label and namespace selectors.
         properties:
           apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
@@ -56,36 +64,40 @@ spec:
                       pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$
                       type: string
                     limit:
-                      description: Limit the number of alerts an alerting rule and
-                        series a recording rule can produce. Limit is supported starting
-                        with Prometheus >= 2.31 and Thanos Ruler >= 0.24.
+                      description: |-
+                        Limit the number of alerts an alerting rule and series a recording
+                        rule can produce.
+                        Limit is supported starting with Prometheus >= 2.31 and Thanos Ruler >= 0.24.
                       type: integer
                     name:
                       description: Name of the rule group.
                       minLength: 1
                       type: string
                     partial_response_strategy:
-                      description: 'PartialResponseStrategy is only used by ThanosRuler
-                        and will be ignored by Prometheus instances. More info: https://github.com/thanos-io/thanos/blob/main/docs/components/rule.md#partial-response'
+                      description: |-
+                        PartialResponseStrategy is only used by ThanosRuler and will
+                        be ignored by Prometheus instances.
+                        More info: https://github.com/thanos-io/thanos/blob/main/docs/components/rule.md#partial-response
                       pattern: ^(?i)(abort|warn)?$
                       type: string
                     rules:
                       description: List of alerting and recording rules.
                       items:
-                        description: 'Rule describes an alerting or recording rule
-                          See Prometheus documentation: [alerting](https://www.prometheus.io/docs/prometheus/latest/configuration/alerting_rules/)
-                          or [recording](https://www.prometheus.io/docs/prometheus/latest/configuration/recording_rules/#recording-rules)
-                          rule'
+                        description: |-
+                          Rule describes an alerting or recording rule
+                          See Prometheus documentation: [alerting](https://www.prometheus.io/docs/prometheus/latest/configuration/alerting_rules/) or [recording](https://www.prometheus.io/docs/prometheus/latest/configuration/recording_rules/#recording-rules) rule
                         properties:
                           alert:
-                            description: Name of the alert. Must be a valid label
-                              value. Only one of `record` and `alert` must be set.
+                            description: |-
+                              Name of the alert. Must be a valid label value.
+                              Only one of `record` and `alert` must be set.
                             type: string
                           annotations:
                             additionalProperties:
                               type: string
-                            description: Annotations to add to each alert. Only valid
-                              for alerting rules.
+                            description: |-
+                              Annotations to add to each alert.
+                              Only valid for alerting rules.
                             type: object
                           expr:
                             anyOf:
@@ -111,9 +123,9 @@ spec:
                             description: Labels to add or overwrite.
                             type: object
                           record:
-                            description: Name of the time series to output to. Must
-                              be a valid metric name. Only one of `record` and `alert`
-                              must be set.
+                            description: |-
+                              Name of the time series to output to. Must be a valid metric name.
+                              Only one of `record` and `alert` must be set.
                             type: string
                         required:
                         - expr

packages/system/victoria-metrics-operator/charts/prometheus-operator-crds/ci/lint.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+{
+    SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)
+
+    cd "${SCRIPT_DIR}/../"
+
+    ./hack/update_crds.sh
+    if ! git diff "$GITHUB_SHA" --color=always --exit-code; then
+      echo "Please run ./hack/update_crds.sh"
+      exit 1
+    fi
+} 2>&1

packages/system/victoria-metrics-operator/charts/prometheus-operator-crds/hack/update_crds.sh

@@ -1,9 +1,11 @@
 #!/bin/bash
 
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
 if [[ $(uname -s) = "Darwin" ]]; then
-    VERSION="$(grep ^appVersion ../Chart.yaml | sed 's/appVersion: /v/g')"
+    VERSION="$(grep ^appVersion "${SCRIPT_DIR}/../Chart.yaml" | sed 's/appVersion: //g')"
 else
-    VERSION="$(grep ^appVersion ../Chart.yaml | sed 's/appVersion:\s/v/g')"
+    VERSION="$(grep ^appVersion "${SCRIPT_DIR}/../Chart.yaml" | sed 's/appVersion:\s//g')"
 fi
 
 FILES=(
@@ -14,8 +16,8 @@ FILES=(
   "crd-prometheusagents.yaml    :  monitoring.coreos.com_prometheusagents.yaml"
   "crd-prometheuses.yaml        :  monitoring.coreos.com_prometheuses.yaml"
   "crd-prometheusrules.yaml     :  monitoring.coreos.com_prometheusrules.yaml"
-  "crd-servicemonitors.yaml     :  monitoring.coreos.com_servicemonitors.yaml"
   "crd-scrapeconfigs.yaml       :  monitoring.coreos.com_scrapeconfigs.yaml"
+  "crd-servicemonitors.yaml     :  monitoring.coreos.com_servicemonitors.yaml"
   "crd-thanosrulers.yaml        :  monitoring.coreos.com_thanosrulers.yaml"
 )
 
@@ -27,18 +29,17 @@ for line in "${FILES[@]}"; do
 
     echo -e "Downloading Prometheus Operator CRD with Version ${VERSION}:\n${URL}\n"
 
-    echo "# ${URL}" > ../templates/"${DESTINATION}"
+    echo "# ${URL}" > "${SCRIPT_DIR}/../charts/crds/templates/${DESTINATION}"
 
-    if ! curl --silent --retry-all-errors --fail --location "${URL}" >> ../templates/"${DESTINATION}"; then
+    if ! curl --silent --retry-all-errors --fail --location "${URL}" >> "${SCRIPT_DIR}/../charts/crds/templates/${DESTINATION}"; then
       echo -e "Failed to download ${URL}!"
       exit 1
     fi
+
     # Update or insert annotations block
-    if yq -e '.metadata.annotations' ../templates/"${DESTINATION}" >/dev/null; then
-      sed -i '/^  annotations:$/a {{- with .Values.annotations }}\n{{- toYaml . | nindent 4 }}\n{{- end }}' ../templates/"${DESTINATION}"
+    if yq -e '.metadata.annotations' "${SCRIPT_DIR}/../charts/crds/templates/${DESTINATION}" >/dev/null; then
+      sed -i '/^  annotations:$/a {{- with .Values.annotations }}\n{{- toYaml . | nindent 4 }}\n{{- end }}' "${SCRIPT_DIR}/../charts/crds/templates/${DESTINATION}"
     else
-      sed -i '/^metadata:$/a {{- with .Values.annotations }}\n  annotations:\n{{- toYaml . | nindent 4 }}\n{{- end }}' ../templates/"${DESTINATION}"
+      sed -i '/^metadata:$/a {{- with .Values.annotations }}\n  annotations:\n{{- toYaml . | nindent 4 }}\n{{- end }}' "${SCRIPT_DIR}/../charts/crds/templates/${DESTINATION}"
     fi
 done
-
-exit

packages/system/victoria-metrics-operator/charts/prometheus-operator-crds/templates/crd-podmonitors.yaml

@@ -1,688 +0,0 @@
-# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.67.0/example/prometheus-operator-crd/monitoring.coreos.com_podmonitors.yaml
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-{{- with .Values.annotations }}
-{{- toYaml . | nindent 4 }}
-{{- end }}
-    controller-gen.kubebuilder.io/version: v0.11.1
-  creationTimestamp: null
-  name: podmonitors.monitoring.coreos.com
-spec:
-  group: monitoring.coreos.com
-  names:
-    categories:
-    - prometheus-operator
-    kind: PodMonitor
-    listKind: PodMonitorList
-    plural: podmonitors
-    shortNames:
-    - pmon
-    singular: podmonitor
-  scope: Namespaced
-  versions:
-  - name: v1
-    schema:
-      openAPIV3Schema:
-        description: PodMonitor defines monitoring for a set of pods.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: Specification of desired Pod selection for target discovery
-              by Prometheus.
-            properties:
-              attachMetadata:
-                description: Attaches node metadata to discovered targets. Requires
-                  Prometheus v2.35.0 and above.
-                properties:
-                  node:
-                    description: When set to true, Prometheus must have permissions
-                      to get Nodes.
-                    type: boolean
-                type: object
-              jobLabel:
-                description: The label to use to retrieve the job name from.
-                type: string
-              labelLimit:
-                description: Per-scrape limit on number of labels that will be accepted
-                  for a sample. Only valid in Prometheus versions 2.27.0 and newer.
-                format: int64
-                type: integer
-              labelNameLengthLimit:
-                description: Per-scrape limit on length of labels name that will be
-                  accepted for a sample. Only valid in Prometheus versions 2.27.0
-                  and newer.
-                format: int64
-                type: integer
-              labelValueLengthLimit:
-                description: Per-scrape limit on length of labels value that will
-                  be accepted for a sample. Only valid in Prometheus versions 2.27.0
-                  and newer.
-                format: int64
-                type: integer
-              namespaceSelector:
-                description: Selector to select which namespaces the Endpoints objects
-                  are discovered from.
-                properties:
-                  any:
-                    description: Boolean describing whether all namespaces are selected
-                      in contrast to a list restricting them.
-                    type: boolean
-                  matchNames:
-                    description: List of namespace names to select from.
-                    items:
-                      type: string
-                    type: array
-                type: object
-              podMetricsEndpoints:
-                description: A list of endpoints allowed as part of this PodMonitor.
-                items:
-                  description: PodMetricsEndpoint defines a scrapeable endpoint of
-                    a Kubernetes Pod serving Prometheus metrics.
-                  properties:
-                    authorization:
-                      description: Authorization section for this endpoint
-                      properties:
-                        credentials:
-                          description: Selects a key of a Secret in the namespace
-                            that contains the credentials for authentication.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                TODO: Add other useful fields. apiVersion, kind, uid?'
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        type:
-                          description: "Defines the authentication type. The value
-                            is case-insensitive. \n \"Basic\" is not a supported value.
-                            \n Default: \"Bearer\""
-                          type: string
-                      type: object
-                    basicAuth:
-                      description: 'BasicAuth allow an endpoint to authenticate over
-                        basic authentication. More info: https://prometheus.io/docs/operating/configuration/#endpoint'
-                      properties:
-                        password:
-                          description: The secret in the service monitor namespace
-                            that contains the password for authentication.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                TODO: Add other useful fields. apiVersion, kind, uid?'
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        username:
-                          description: The secret in the service monitor namespace
-                            that contains the username for authentication.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                TODO: Add other useful fields. apiVersion, kind, uid?'
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                      type: object
-                    bearerTokenSecret:
-                      description: Secret to mount to read bearer token for scraping
-                        targets. The secret needs to be in the same namespace as the
-                        pod monitor and accessible by the Prometheus Operator.
-                      properties:
-                        key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
-                          type: string
-                        name:
-                          description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            TODO: Add other useful fields. apiVersion, kind, uid?'
-                          type: string
-                        optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
-                          type: boolean
-                      required:
-                      - key
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    enableHttp2:
-                      description: Whether to enable HTTP2.
-                      type: boolean
-                    filterRunning:
-                      description: 'Drop pods that are not running. (Failed, Succeeded).
-                        Enabled by default. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-phase'
-                      type: boolean
-                    followRedirects:
-                      description: FollowRedirects configures whether scrape requests
-                        follow HTTP 3xx redirects.
-                      type: boolean
-                    honorLabels:
-                      description: HonorLabels chooses the metric's labels on collisions
-                        with target labels.
-                      type: boolean
-                    honorTimestamps:
-                      description: HonorTimestamps controls whether Prometheus respects
-                        the timestamps present in scraped data.
-                      type: boolean
-                    interval:
-                      description: Interval at which metrics should be scraped If
-                        not specified Prometheus' global scrape interval is used.
-                      pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$
-                      type: string
-                    metricRelabelings:
-                      description: MetricRelabelConfigs to apply to samples before
-                        ingestion.
-                      items:
-                        description: "RelabelConfig allows dynamic rewriting of the
-                          label set for targets, alerts, scraped samples and remote
-                          write samples. \n More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config"
-                        properties:
-                          action:
-                            default: replace
-                            description: "Action to perform based on the regex matching.
-                              \n `Uppercase` and `Lowercase` actions require Prometheus
-                              >= v2.36.0. `DropEqual` and `KeepEqual` actions require
-                              Prometheus >= v2.41.0. \n Default: \"Replace\""
-                            enum:
-                            - replace
-                            - Replace
-                            - keep
-                            - Keep
-                            - drop
-                            - Drop
-                            - hashmod
-                            - HashMod
-                            - labelmap
-                            - LabelMap
-                            - labeldrop
-                            - LabelDrop
-                            - labelkeep
-                            - LabelKeep
-                            - lowercase
-                            - Lowercase
-                            - uppercase
-                            - Uppercase
-                            - keepequal
-                            - KeepEqual
-                            - dropequal
-                            - DropEqual
-                            type: string
-                          modulus:
-                            description: "Modulus to take of the hash of the source
-                              label values. \n Only applicable when the action is
-                              `HashMod`."
-                            format: int64
-                            type: integer
-                          regex:
-                            description: Regular expression against which the extracted
-                              value is matched.
-                            type: string
-                          replacement:
-                            description: "Replacement value against which a Replace
-                              action is performed if the regular expression matches.
-                              \n Regex capture groups are available."
-                            type: string
-                          separator:
-                            description: Separator is the string between concatenated
-                              SourceLabels.
-                            type: string
-                          sourceLabels:
-                            description: The source labels select values from existing
-                              labels. Their content is concatenated using the configured
-                              Separator and matched against the configured regular
-                              expression.
-                            items:
-                              description: LabelName is a valid Prometheus label name
-                                which may only contain ASCII letters, numbers, as
-                                well as underscores.
-                              pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$
-                              type: string
-                            type: array
-                          targetLabel:
-                            description: "Label to which the resulting string is written
-                              in a replacement. \n It is mandatory for `Replace`,
-                              `HashMod`, `Lowercase`, `Uppercase`, `KeepEqual` and
-                              `DropEqual` actions. \n Regex capture groups are available."
-                            type: string
-                        type: object
-                      type: array
-                    oauth2:
-                      description: OAuth2 for the URL. Only valid in Prometheus versions
-                        2.27.0 and newer.
-                      properties:
-                        clientId:
-                          description: The secret or configmap containing the OAuth2
-                            client id
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    TODO: Add other useful fields. apiVersion, kind,
-                                    uid?'
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    TODO: Add other useful fields. apiVersion, kind,
-                                    uid?'
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        clientSecret:
-                          description: The secret containing the OAuth2 client secret
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                TODO: Add other useful fields. apiVersion, kind, uid?'
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        endpointParams:
-                          additionalProperties:
-                            type: string
-                          description: Parameters to append to the token URL
-                          type: object
-                        scopes:
-                          description: OAuth2 scopes used for the token request
-                          items:
-                            type: string
-                          type: array
-                        tokenUrl:
-                          description: The URL to fetch the token from
-                          minLength: 1
-                          type: string
-                      required:
-                      - clientId
-                      - clientSecret
-                      - tokenUrl
-                      type: object
-                    params:
-                      additionalProperties:
-                        items:
-                          type: string
-                        type: array
-                      description: Optional HTTP URL parameters
-                      type: object
-                    path:
-                      description: HTTP path to scrape for metrics. If empty, Prometheus
-                        uses the default value (e.g. `/metrics`).
-                      type: string
-                    port:
-                      description: Name of the pod port this endpoint refers to. Mutually
-                        exclusive with targetPort.
-                      type: string
-                    proxyUrl:
-                      description: ProxyURL eg http://proxyserver:2195 Directs scrapes
-                        to proxy through this endpoint.
-                      type: string
-                    relabelings:
-                      description: 'RelabelConfigs to apply to samples before scraping.
-                        Prometheus Operator automatically adds relabelings for a few
-                        standard Kubernetes fields. The original scrape job''s name
-                        is available via the `__tmp_prometheus_job_name` label. More
-                        info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config'
-                      items:
-                        description: "RelabelConfig allows dynamic rewriting of the
-                          label set for targets, alerts, scraped samples and remote
-                          write samples. \n More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config"
-                        properties:
-                          action:
-                            default: replace
-                            description: "Action to perform based on the regex matching.
-                              \n `Uppercase` and `Lowercase` actions require Prometheus
-                              >= v2.36.0. `DropEqual` and `KeepEqual` actions require
-                              Prometheus >= v2.41.0. \n Default: \"Replace\""
-                            enum:
-                            - replace
-                            - Replace
-                            - keep
-                            - Keep
-                            - drop
-                            - Drop
-                            - hashmod
-                            - HashMod
-                            - labelmap
-                            - LabelMap
-                            - labeldrop
-                            - LabelDrop
-                            - labelkeep
-                            - LabelKeep
-                            - lowercase
-                            - Lowercase
-                            - uppercase
-                            - Uppercase
-                            - keepequal
-                            - KeepEqual
-                            - dropequal
-                            - DropEqual
-                            type: string
-                          modulus:
-                            description: "Modulus to take of the hash of the source
-                              label values. \n Only applicable when the action is
-                              `HashMod`."
-                            format: int64
-                            type: integer
-                          regex:
-                            description: Regular expression against which the extracted
-                              value is matched.
-                            type: string
-                          replacement:
-                            description: "Replacement value against which a Replace
-                              action is performed if the regular expression matches.
-                              \n Regex capture groups are available."
-                            type: string
-                          separator:
-                            description: Separator is the string between concatenated
-                              SourceLabels.
-                            type: string
-                          sourceLabels:
-                            description: The source labels select values from existing
-                              labels. Their content is concatenated using the configured
-                              Separator and matched against the configured regular
-                              expression.
-                            items:
-                              description: LabelName is a valid Prometheus label name
-                                which may only contain ASCII letters, numbers, as
-                                well as underscores.
-                              pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$
-                              type: string
-                            type: array
-                          targetLabel:
-                            description: "Label to which the resulting string is written
-                              in a replacement. \n It is mandatory for `Replace`,
-                              `HashMod`, `Lowercase`, `Uppercase`, `KeepEqual` and
-                              `DropEqual` actions. \n Regex capture groups are available."
-                            type: string
-                        type: object
-                      type: array
-                    scheme:
-                      description: HTTP scheme to use for scraping. `http` and `https`
-                        are the expected values unless you rewrite the `__scheme__`
-                        label via relabeling. If empty, Prometheus uses the default
-                        value `http`.
-                      enum:
-                      - http
-                      - https
-                      type: string
-                    scrapeTimeout:
-                      description: Timeout after which the scrape is ended If not
-                        specified, the Prometheus global scrape interval is used.
-                      pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$
-                      type: string
-                    targetPort:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      description: 'Deprecated: Use ''port'' instead.'
-                      x-kubernetes-int-or-string: true
-                    tlsConfig:
-                      description: TLS configuration to use when scraping the endpoint.
-                      properties:
-                        ca:
-                          description: Certificate authority used when verifying server
-                            certificates.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    TODO: Add other useful fields. apiVersion, kind,
-                                    uid?'
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    TODO: Add other useful fields. apiVersion, kind,
-                                    uid?'
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        cert:
-                          description: Client certificate to present when doing client-authentication.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    TODO: Add other useful fields. apiVersion, kind,
-                                    uid?'
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    TODO: Add other useful fields. apiVersion, kind,
-                                    uid?'
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        insecureSkipVerify:
-                          description: Disable target certificate validation.
-                          type: boolean
-                        keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                TODO: Add other useful fields. apiVersion, kind, uid?'
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        serverName:
-                          description: Used to verify the hostname for the targets.
-                          type: string
-                      type: object
-                  type: object
-                type: array
-              podTargetLabels:
-                description: PodTargetLabels transfers labels on the Kubernetes Pod
-                  onto the target.
-                items:
-                  type: string
-                type: array
-              sampleLimit:
-                description: SampleLimit defines per-scrape limit on number of scraped
-                  samples that will be accepted.
-                format: int64
-                type: integer
-              selector:
-                description: Selector to select Pod objects.
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: A label selector requirement is a selector that
-                        contains values, a key, and an operator that relates the key
-                        and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: operator represents a key's relationship to
-                            a set of values. Valid operators are In, NotIn, Exists
-                            and DoesNotExist.
-                          type: string
-                        values:
-                          description: values is an array of string values. If the
-                            operator is In or NotIn, the values array must be non-empty.
-                            If the operator is Exists or DoesNotExist, the values
-                            array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: matchLabels is a map of {key,value} pairs. A single
-                      {key,value} in the matchLabels map is equivalent to an element
-                      of matchExpressions, whose key field is "key", the operator
-                      is "In", and the values array contains only "value". The requirements
-                      are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              targetLimit:
-                description: TargetLimit defines a limit on the number of scraped
-                  targets that will be accepted.
-                format: int64
-                type: integer
-            required:
-            - podMetricsEndpoints
-            - selector
-            type: object
-        required:
-        - spec
-        type: object
-    served: true
-    storage: true

packages/system/victoria-metrics-operator/charts/prometheus-operator-crds/templates/crd-probes.yaml

@@ -1,730 +0,0 @@
-# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.67.0/example/prometheus-operator-crd/monitoring.coreos.com_probes.yaml
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-{{- with .Values.annotations }}
-{{- toYaml . | nindent 4 }}
-{{- end }}
-    controller-gen.kubebuilder.io/version: v0.11.1
-  creationTimestamp: null
-  name: probes.monitoring.coreos.com
-spec:
-  group: monitoring.coreos.com
-  names:
-    categories:
-    - prometheus-operator
-    kind: Probe
-    listKind: ProbeList
-    plural: probes
-    shortNames:
-    - prb
-    singular: probe
-  scope: Namespaced
-  versions:
-  - name: v1
-    schema:
-      openAPIV3Schema:
-        description: Probe defines monitoring for a set of static targets or ingresses.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: Specification of desired Ingress selection for target discovery
-              by Prometheus.
-            properties:
-              authorization:
-                description: Authorization section for this endpoint
-                properties:
-                  credentials:
-                    description: Selects a key of a Secret in the namespace that contains
-                      the credentials for authentication.
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          TODO: Add other useful fields. apiVersion, kind, uid?'
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  type:
-                    description: "Defines the authentication type. The value is case-insensitive.
-                      \n \"Basic\" is not a supported value. \n Default: \"Bearer\""
-                    type: string
-                type: object
-              basicAuth:
-                description: 'BasicAuth allow an endpoint to authenticate over basic
-                  authentication. More info: https://prometheus.io/docs/operating/configuration/#endpoint'
-                properties:
-                  password:
-                    description: The secret in the service monitor namespace that
-                      contains the password for authentication.
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          TODO: Add other useful fields. apiVersion, kind, uid?'
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  username:
-                    description: The secret in the service monitor namespace that
-                      contains the username for authentication.
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          TODO: Add other useful fields. apiVersion, kind, uid?'
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                type: object
-              bearerTokenSecret:
-                description: Secret to mount to read bearer token for scraping targets.
-                  The secret needs to be in the same namespace as the probe and accessible
-                  by the Prometheus Operator.
-                properties:
-                  key:
-                    description: The key of the secret to select from.  Must be a
-                      valid secret key.
-                    type: string
-                  name:
-                    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                      TODO: Add other useful fields. apiVersion, kind, uid?'
-                    type: string
-                  optional:
-                    description: Specify whether the Secret or its key must be defined
-                    type: boolean
-                required:
-                - key
-                type: object
-                x-kubernetes-map-type: atomic
-              interval:
-                description: Interval at which targets are probed using the configured
-                  prober. If not specified Prometheus' global scrape interval is used.
-                pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$
-                type: string
-              jobName:
-                description: The job name assigned to scraped metrics by default.
-                type: string
-              labelLimit:
-                description: Per-scrape limit on number of labels that will be accepted
-                  for a sample. Only valid in Prometheus versions 2.27.0 and newer.
-                format: int64
-                type: integer
-              labelNameLengthLimit:
-                description: Per-scrape limit on length of labels name that will be
-                  accepted for a sample. Only valid in Prometheus versions 2.27.0
-                  and newer.
-                format: int64
-                type: integer
-              labelValueLengthLimit:
-                description: Per-scrape limit on length of labels value that will
-                  be accepted for a sample. Only valid in Prometheus versions 2.27.0
-                  and newer.
-                format: int64
-                type: integer
-              metricRelabelings:
-                description: MetricRelabelConfigs to apply to samples before ingestion.
-                items:
-                  description: "RelabelConfig allows dynamic rewriting of the label
-                    set for targets, alerts, scraped samples and remote write samples.
-                    \n More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config"
-                  properties:
-                    action:
-                      default: replace
-                      description: "Action to perform based on the regex matching.
-                        \n `Uppercase` and `Lowercase` actions require Prometheus
-                        >= v2.36.0. `DropEqual` and `KeepEqual` actions require Prometheus
-                        >= v2.41.0. \n Default: \"Replace\""
-                      enum:
-                      - replace
-                      - Replace
-                      - keep
-                      - Keep
-                      - drop
-                      - Drop
-                      - hashmod
-                      - HashMod
-                      - labelmap
-                      - LabelMap
-                      - labeldrop
-                      - LabelDrop
-                      - labelkeep
-                      - LabelKeep
-                      - lowercase
-                      - Lowercase
-                      - uppercase
-                      - Uppercase
-                      - keepequal
-                      - KeepEqual
-                      - dropequal
-                      - DropEqual
-                      type: string
-                    modulus:
-                      description: "Modulus to take of the hash of the source label
-                        values. \n Only applicable when the action is `HashMod`."
-                      format: int64
-                      type: integer
-                    regex:
-                      description: Regular expression against which the extracted
-                        value is matched.
-                      type: string
-                    replacement:
-                      description: "Replacement value against which a Replace action
-                        is performed if the regular expression matches. \n Regex capture
-                        groups are available."
-                      type: string
-                    separator:
-                      description: Separator is the string between concatenated SourceLabels.
-                      type: string
-                    sourceLabels:
-                      description: The source labels select values from existing labels.
-                        Their content is concatenated using the configured Separator
-                        and matched against the configured regular expression.
-                      items:
-                        description: LabelName is a valid Prometheus label name which
-                          may only contain ASCII letters, numbers, as well as underscores.
-                        pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$
-                        type: string
-                      type: array
-                    targetLabel:
-                      description: "Label to which the resulting string is written
-                        in a replacement. \n It is mandatory for `Replace`, `HashMod`,
-                        `Lowercase`, `Uppercase`, `KeepEqual` and `DropEqual` actions.
-                        \n Regex capture groups are available."
-                      type: string
-                  type: object
-                type: array
-              module:
-                description: 'The module to use for probing specifying how to probe
-                  the target. Example module configuring in the blackbox exporter:
-                  https://github.com/prometheus/blackbox_exporter/blob/master/example.yml'
-                type: string
-              oauth2:
-                description: OAuth2 for the URL. Only valid in Prometheus versions
-                  2.27.0 and newer.
-                properties:
-                  clientId:
-                    description: The secret or configmap containing the OAuth2 client
-                      id
-                    properties:
-                      configMap:
-                        description: ConfigMap containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key to select.
-                            type: string
-                          name:
-                            description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              TODO: Add other useful fields. apiVersion, kind, uid?'
-                            type: string
-                          optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      secret:
-                        description: Secret containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              TODO: Add other useful fields. apiVersion, kind, uid?'
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  clientSecret:
-                    description: The secret containing the OAuth2 client secret
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          TODO: Add other useful fields. apiVersion, kind, uid?'
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  endpointParams:
-                    additionalProperties:
-                      type: string
-                    description: Parameters to append to the token URL
-                    type: object
-                  scopes:
-                    description: OAuth2 scopes used for the token request
-                    items:
-                      type: string
-                    type: array
-                  tokenUrl:
-                    description: The URL to fetch the token from
-                    minLength: 1
-                    type: string
-                required:
-                - clientId
-                - clientSecret
-                - tokenUrl
-                type: object
-              prober:
-                description: Specification for the prober to use for probing targets.
-                  The prober.URL parameter is required. Targets cannot be probed if
-                  left empty.
-                properties:
-                  path:
-                    default: /probe
-                    description: Path to collect metrics from. Defaults to `/probe`.
-                    type: string
-                  proxyUrl:
-                    description: Optional ProxyURL.
-                    type: string
-                  scheme:
-                    description: HTTP scheme to use for scraping. `http` and `https`
-                      are the expected values unless you rewrite the `__scheme__`
-                      label via relabeling. If empty, Prometheus uses the default
-                      value `http`.
-                    enum:
-                    - http
-                    - https
-                    type: string
-                  url:
-                    description: Mandatory URL of the prober.
-                    type: string
-                required:
-                - url
-                type: object
-              sampleLimit:
-                description: SampleLimit defines per-scrape limit on number of scraped
-                  samples that will be accepted.
-                format: int64
-                type: integer
-              scrapeTimeout:
-                description: Timeout for scraping metrics from the Prometheus exporter.
-                  If not specified, the Prometheus global scrape timeout is used.
-                pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$
-                type: string
-              targetLimit:
-                description: TargetLimit defines a limit on the number of scraped
-                  targets that will be accepted.
-                format: int64
-                type: integer
-              targets:
-                description: Targets defines a set of static or dynamically discovered
-                  targets to probe.
-                properties:
-                  ingress:
-                    description: ingress defines the Ingress objects to probe and
-                      the relabeling configuration. If `staticConfig` is also defined,
-                      `staticConfig` takes precedence.
-                    properties:
-                      namespaceSelector:
-                        description: From which namespaces to select Ingress objects.
-                        properties:
-                          any:
-                            description: Boolean describing whether all namespaces
-                              are selected in contrast to a list restricting them.
-                            type: boolean
-                          matchNames:
-                            description: List of namespace names to select from.
-                            items:
-                              type: string
-                            type: array
-                        type: object
-                      relabelingConfigs:
-                        description: 'RelabelConfigs to apply to the label set of
-                          the target before it gets scraped. The original ingress
-                          address is available via the `__tmp_prometheus_ingress_address`
-                          label. It can be used to customize the probed URL. The original
-                          scrape job''s name is available via the `__tmp_prometheus_job_name`
-                          label. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config'
-                        items:
-                          description: "RelabelConfig allows dynamic rewriting of
-                            the label set for targets, alerts, scraped samples and
-                            remote write samples. \n More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config"
-                          properties:
-                            action:
-                              default: replace
-                              description: "Action to perform based on the regex matching.
-                                \n `Uppercase` and `Lowercase` actions require Prometheus
-                                >= v2.36.0. `DropEqual` and `KeepEqual` actions require
-                                Prometheus >= v2.41.0. \n Default: \"Replace\""
-                              enum:
-                              - replace
-                              - Replace
-                              - keep
-                              - Keep
-                              - drop
-                              - Drop
-                              - hashmod
-                              - HashMod
-                              - labelmap
-                              - LabelMap
-                              - labeldrop
-                              - LabelDrop
-                              - labelkeep
-                              - LabelKeep
-                              - lowercase
-                              - Lowercase
-                              - uppercase
-                              - Uppercase
-                              - keepequal
-                              - KeepEqual
-                              - dropequal
-                              - DropEqual
-                              type: string
-                            modulus:
-                              description: "Modulus to take of the hash of the source
-                                label values. \n Only applicable when the action is
-                                `HashMod`."
-                              format: int64
-                              type: integer
-                            regex:
-                              description: Regular expression against which the extracted
-                                value is matched.
-                              type: string
-                            replacement:
-                              description: "Replacement value against which a Replace
-                                action is performed if the regular expression matches.
-                                \n Regex capture groups are available."
-                              type: string
-                            separator:
-                              description: Separator is the string between concatenated
-                                SourceLabels.
-                              type: string
-                            sourceLabels:
-                              description: The source labels select values from existing
-                                labels. Their content is concatenated using the configured
-                                Separator and matched against the configured regular
-                                expression.
-                              items:
-                                description: LabelName is a valid Prometheus label
-                                  name which may only contain ASCII letters, numbers,
-                                  as well as underscores.
-                                pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$
-                                type: string
-                              type: array
-                            targetLabel:
-                              description: "Label to which the resulting string is
-                                written in a replacement. \n It is mandatory for `Replace`,
-                                `HashMod`, `Lowercase`, `Uppercase`, `KeepEqual` and
-                                `DropEqual` actions. \n Regex capture groups are available."
-                              type: string
-                          type: object
-                        type: array
-                      selector:
-                        description: Selector to select the Ingress objects.
-                        properties:
-                          matchExpressions:
-                            description: matchExpressions is a list of label selector
-                              requirements. The requirements are ANDed.
-                            items:
-                              description: A label selector requirement is a selector
-                                that contains values, a key, and an operator that
-                                relates the key and values.
-                              properties:
-                                key:
-                                  description: key is the label key that the selector
-                                    applies to.
-                                  type: string
-                                operator:
-                                  description: operator represents a key's relationship
-                                    to a set of values. Valid operators are In, NotIn,
-                                    Exists and DoesNotExist.
-                                  type: string
-                                values:
-                                  description: values is an array of string values.
-                                    If the operator is In or NotIn, the values array
-                                    must be non-empty. If the operator is Exists or
-                                    DoesNotExist, the values array must be empty.
-                                    This array is replaced during a strategic merge
-                                    patch.
-                                  items:
-                                    type: string
-                                  type: array
-                              required:
-                              - key
-                              - operator
-                              type: object
-                            type: array
-                          matchLabels:
-                            additionalProperties:
-                              type: string
-                            description: matchLabels is a map of {key,value} pairs.
-                              A single {key,value} in the matchLabels map is equivalent
-                              to an element of matchExpressions, whose key field is
-                              "key", the operator is "In", and the values array contains
-                              only "value". The requirements are ANDed.
-                            type: object
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  staticConfig:
-                    description: 'staticConfig defines the static list of targets
-                      to probe and the relabeling configuration. If `ingress` is also
-                      defined, `staticConfig` takes precedence. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#static_config.'
-                    properties:
-                      labels:
-                        additionalProperties:
-                          type: string
-                        description: Labels assigned to all metrics scraped from the
-                          targets.
-                        type: object
-                      relabelingConfigs:
-                        description: 'RelabelConfigs to apply to the label set of
-                          the targets before it gets scraped. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config'
-                        items:
-                          description: "RelabelConfig allows dynamic rewriting of
-                            the label set for targets, alerts, scraped samples and
-                            remote write samples. \n More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config"
-                          properties:
-                            action:
-                              default: replace
-                              description: "Action to perform based on the regex matching.
-                                \n `Uppercase` and `Lowercase` actions require Prometheus
-                                >= v2.36.0. `DropEqual` and `KeepEqual` actions require
-                                Prometheus >= v2.41.0. \n Default: \"Replace\""
-                              enum:
-                              - replace
-                              - Replace
-                              - keep
-                              - Keep
-                              - drop
-                              - Drop
-                              - hashmod
-                              - HashMod
-                              - labelmap
-                              - LabelMap
-                              - labeldrop
-                              - LabelDrop
-                              - labelkeep
-                              - LabelKeep
-                              - lowercase
-                              - Lowercase
-                              - uppercase
-                              - Uppercase
-                              - keepequal
-                              - KeepEqual
-                              - dropequal
-                              - DropEqual
-                              type: string
-                            modulus:
-                              description: "Modulus to take of the hash of the source
-                                label values. \n Only applicable when the action is
-                                `HashMod`."
-                              format: int64
-                              type: integer
-                            regex:
-                              description: Regular expression against which the extracted
-                                value is matched.
-                              type: string
-                            replacement:
-                              description: "Replacement value against which a Replace
-                                action is performed if the regular expression matches.
-                                \n Regex capture groups are available."
-                              type: string
-                            separator:
-                              description: Separator is the string between concatenated
-                                SourceLabels.
-                              type: string
-                            sourceLabels:
-                              description: The source labels select values from existing
-                                labels. Their content is concatenated using the configured
-                                Separator and matched against the configured regular
-                                expression.
-                              items:
-                                description: LabelName is a valid Prometheus label
-                                  name which may only contain ASCII letters, numbers,
-                                  as well as underscores.
-                                pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$
-                                type: string
-                              type: array
-                            targetLabel:
-                              description: "Label to which the resulting string is
-                                written in a replacement. \n It is mandatory for `Replace`,
-                                `HashMod`, `Lowercase`, `Uppercase`, `KeepEqual` and
-                                `DropEqual` actions. \n Regex capture groups are available."
-                              type: string
-                          type: object
-                        type: array
-                      static:
-                        description: The list of hosts to probe.
-                        items:
-                          type: string
-                        type: array
-                    type: object
-                type: object
-              tlsConfig:
-                description: TLS configuration to use when scraping the endpoint.
-                properties:
-                  ca:
-                    description: Certificate authority used when verifying server
-                      certificates.
-                    properties:
-                      configMap:
-                        description: ConfigMap containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key to select.
-                            type: string
-                          name:
-                            description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              TODO: Add other useful fields. apiVersion, kind, uid?'
-                            type: string
-                          optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      secret:
-                        description: Secret containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              TODO: Add other useful fields. apiVersion, kind, uid?'
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  cert:
-                    description: Client certificate to present when doing client-authentication.
-                    properties:
-                      configMap:
-                        description: ConfigMap containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key to select.
-                            type: string
-                          name:
-                            description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              TODO: Add other useful fields. apiVersion, kind, uid?'
-                            type: string
-                          optional:
-                            description: Specify whether the ConfigMap or its key
-                              must be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                      secret:
-                        description: Secret containing data to use for the targets.
-                        properties:
-                          key:
-                            description: The key of the secret to select from.  Must
-                              be a valid secret key.
-                            type: string
-                          name:
-                            description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                              TODO: Add other useful fields. apiVersion, kind, uid?'
-                            type: string
-                          optional:
-                            description: Specify whether the Secret or its key must
-                              be defined
-                            type: boolean
-                        required:
-                        - key
-                        type: object
-                        x-kubernetes-map-type: atomic
-                    type: object
-                  insecureSkipVerify:
-                    description: Disable target certificate validation.
-                    type: boolean
-                  keySecret:
-                    description: Secret containing the client key file for the targets.
-                    properties:
-                      key:
-                        description: The key of the secret to select from.  Must be
-                          a valid secret key.
-                        type: string
-                      name:
-                        description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                          TODO: Add other useful fields. apiVersion, kind, uid?'
-                        type: string
-                      optional:
-                        description: Specify whether the Secret or its key must be
-                          defined
-                        type: boolean
-                    required:
-                    - key
-                    type: object
-                    x-kubernetes-map-type: atomic
-                  serverName:
-                    description: Used to verify the hostname for the targets.
-                    type: string
-                type: object
-            type: object
-        required:
-        - spec
-        type: object
-    served: true
-    storage: true

packages/system/victoria-metrics-operator/charts/prometheus-operator-crds/templates/crd-servicemonitors.yaml

@@ -1,718 +0,0 @@
-# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.67.0/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-{{- with .Values.annotations }}
-{{- toYaml . | nindent 4 }}
-{{- end }}
-    controller-gen.kubebuilder.io/version: v0.11.1
-  creationTimestamp: null
-  name: servicemonitors.monitoring.coreos.com
-spec:
-  group: monitoring.coreos.com
-  names:
-    categories:
-    - prometheus-operator
-    kind: ServiceMonitor
-    listKind: ServiceMonitorList
-    plural: servicemonitors
-    shortNames:
-    - smon
-    singular: servicemonitor
-  scope: Namespaced
-  versions:
-  - name: v1
-    schema:
-      openAPIV3Schema:
-        description: ServiceMonitor defines monitoring for a set of services.
-        properties:
-          apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-            type: string
-          kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-            type: string
-          metadata:
-            type: object
-          spec:
-            description: Specification of desired Service selection for target discovery
-              by Prometheus.
-            properties:
-              attachMetadata:
-                description: Attaches node metadata to discovered targets. Requires
-                  Prometheus v2.37.0 and above.
-                properties:
-                  node:
-                    description: When set to true, Prometheus must have permissions
-                      to get Nodes.
-                    type: boolean
-                type: object
-              endpoints:
-                description: A list of endpoints allowed as part of this ServiceMonitor.
-                items:
-                  description: Endpoint defines a scrapeable endpoint serving Prometheus
-                    metrics.
-                  properties:
-                    authorization:
-                      description: Authorization section for this endpoint
-                      properties:
-                        credentials:
-                          description: Selects a key of a Secret in the namespace
-                            that contains the credentials for authentication.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                TODO: Add other useful fields. apiVersion, kind, uid?'
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        type:
-                          description: "Defines the authentication type. The value
-                            is case-insensitive. \n \"Basic\" is not a supported value.
-                            \n Default: \"Bearer\""
-                          type: string
-                      type: object
-                    basicAuth:
-                      description: 'BasicAuth allow an endpoint to authenticate over
-                        basic authentication More info: https://prometheus.io/docs/operating/configuration/#endpoints'
-                      properties:
-                        password:
-                          description: The secret in the service monitor namespace
-                            that contains the password for authentication.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                TODO: Add other useful fields. apiVersion, kind, uid?'
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        username:
-                          description: The secret in the service monitor namespace
-                            that contains the username for authentication.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                TODO: Add other useful fields. apiVersion, kind, uid?'
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                      type: object
-                    bearerTokenFile:
-                      description: File to read bearer token for scraping targets.
-                      type: string
-                    bearerTokenSecret:
-                      description: Secret to mount to read bearer token for scraping
-                        targets. The secret needs to be in the same namespace as the
-                        service monitor and accessible by the Prometheus Operator.
-                      properties:
-                        key:
-                          description: The key of the secret to select from.  Must
-                            be a valid secret key.
-                          type: string
-                        name:
-                          description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                            TODO: Add other useful fields. apiVersion, kind, uid?'
-                          type: string
-                        optional:
-                          description: Specify whether the Secret or its key must
-                            be defined
-                          type: boolean
-                      required:
-                      - key
-                      type: object
-                      x-kubernetes-map-type: atomic
-                    enableHttp2:
-                      description: Whether to enable HTTP2.
-                      type: boolean
-                    filterRunning:
-                      description: 'Drop pods that are not running. (Failed, Succeeded).
-                        Enabled by default. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-phase'
-                      type: boolean
-                    followRedirects:
-                      description: FollowRedirects configures whether scrape requests
-                        follow HTTP 3xx redirects.
-                      type: boolean
-                    honorLabels:
-                      description: HonorLabels chooses the metric's labels on collisions
-                        with target labels.
-                      type: boolean
-                    honorTimestamps:
-                      description: HonorTimestamps controls whether Prometheus respects
-                        the timestamps present in scraped data.
-                      type: boolean
-                    interval:
-                      description: Interval at which metrics should be scraped If
-                        not specified Prometheus' global scrape interval is used.
-                      pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$
-                      type: string
-                    metricRelabelings:
-                      description: MetricRelabelConfigs to apply to samples before
-                        ingestion.
-                      items:
-                        description: "RelabelConfig allows dynamic rewriting of the
-                          label set for targets, alerts, scraped samples and remote
-                          write samples. \n More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config"
-                        properties:
-                          action:
-                            default: replace
-                            description: "Action to perform based on the regex matching.
-                              \n `Uppercase` and `Lowercase` actions require Prometheus
-                              >= v2.36.0. `DropEqual` and `KeepEqual` actions require
-                              Prometheus >= v2.41.0. \n Default: \"Replace\""
-                            enum:
-                            - replace
-                            - Replace
-                            - keep
-                            - Keep
-                            - drop
-                            - Drop
-                            - hashmod
-                            - HashMod
-                            - labelmap
-                            - LabelMap
-                            - labeldrop
-                            - LabelDrop
-                            - labelkeep
-                            - LabelKeep
-                            - lowercase
-                            - Lowercase
-                            - uppercase
-                            - Uppercase
-                            - keepequal
-                            - KeepEqual
-                            - dropequal
-                            - DropEqual
-                            type: string
-                          modulus:
-                            description: "Modulus to take of the hash of the source
-                              label values. \n Only applicable when the action is
-                              `HashMod`."
-                            format: int64
-                            type: integer
-                          regex:
-                            description: Regular expression against which the extracted
-                              value is matched.
-                            type: string
-                          replacement:
-                            description: "Replacement value against which a Replace
-                              action is performed if the regular expression matches.
-                              \n Regex capture groups are available."
-                            type: string
-                          separator:
-                            description: Separator is the string between concatenated
-                              SourceLabels.
-                            type: string
-                          sourceLabels:
-                            description: The source labels select values from existing
-                              labels. Their content is concatenated using the configured
-                              Separator and matched against the configured regular
-                              expression.
-                            items:
-                              description: LabelName is a valid Prometheus label name
-                                which may only contain ASCII letters, numbers, as
-                                well as underscores.
-                              pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$
-                              type: string
-                            type: array
-                          targetLabel:
-                            description: "Label to which the resulting string is written
-                              in a replacement. \n It is mandatory for `Replace`,
-                              `HashMod`, `Lowercase`, `Uppercase`, `KeepEqual` and
-                              `DropEqual` actions. \n Regex capture groups are available."
-                            type: string
-                        type: object
-                      type: array
-                    oauth2:
-                      description: OAuth2 for the URL. Only valid in Prometheus versions
-                        2.27.0 and newer.
-                      properties:
-                        clientId:
-                          description: The secret or configmap containing the OAuth2
-                            client id
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    TODO: Add other useful fields. apiVersion, kind,
-                                    uid?'
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    TODO: Add other useful fields. apiVersion, kind,
-                                    uid?'
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        clientSecret:
-                          description: The secret containing the OAuth2 client secret
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                TODO: Add other useful fields. apiVersion, kind, uid?'
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        endpointParams:
-                          additionalProperties:
-                            type: string
-                          description: Parameters to append to the token URL
-                          type: object
-                        scopes:
-                          description: OAuth2 scopes used for the token request
-                          items:
-                            type: string
-                          type: array
-                        tokenUrl:
-                          description: The URL to fetch the token from
-                          minLength: 1
-                          type: string
-                      required:
-                      - clientId
-                      - clientSecret
-                      - tokenUrl
-                      type: object
-                    params:
-                      additionalProperties:
-                        items:
-                          type: string
-                        type: array
-                      description: Optional HTTP URL parameters
-                      type: object
-                    path:
-                      description: HTTP path to scrape for metrics. If empty, Prometheus
-                        uses the default value (e.g. `/metrics`).
-                      type: string
-                    port:
-                      description: Name of the service port this endpoint refers to.
-                        Mutually exclusive with targetPort.
-                      type: string
-                    proxyUrl:
-                      description: ProxyURL eg http://proxyserver:2195 Directs scrapes
-                        to proxy through this endpoint.
-                      type: string
-                    relabelings:
-                      description: 'RelabelConfigs to apply to samples before scraping.
-                        Prometheus Operator automatically adds relabelings for a few
-                        standard Kubernetes fields. The original scrape job''s name
-                        is available via the `__tmp_prometheus_job_name` label. More
-                        info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config'
-                      items:
-                        description: "RelabelConfig allows dynamic rewriting of the
-                          label set for targets, alerts, scraped samples and remote
-                          write samples. \n More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config"
-                        properties:
-                          action:
-                            default: replace
-                            description: "Action to perform based on the regex matching.
-                              \n `Uppercase` and `Lowercase` actions require Prometheus
-                              >= v2.36.0. `DropEqual` and `KeepEqual` actions require
-                              Prometheus >= v2.41.0. \n Default: \"Replace\""
-                            enum:
-                            - replace
-                            - Replace
-                            - keep
-                            - Keep
-                            - drop
-                            - Drop
-                            - hashmod
-                            - HashMod
-                            - labelmap
-                            - LabelMap
-                            - labeldrop
-                            - LabelDrop
-                            - labelkeep
-                            - LabelKeep
-                            - lowercase
-                            - Lowercase
-                            - uppercase
-                            - Uppercase
-                            - keepequal
-                            - KeepEqual
-                            - dropequal
-                            - DropEqual
-                            type: string
-                          modulus:
-                            description: "Modulus to take of the hash of the source
-                              label values. \n Only applicable when the action is
-                              `HashMod`."
-                            format: int64
-                            type: integer
-                          regex:
-                            description: Regular expression against which the extracted
-                              value is matched.
-                            type: string
-                          replacement:
-                            description: "Replacement value against which a Replace
-                              action is performed if the regular expression matches.
-                              \n Regex capture groups are available."
-                            type: string
-                          separator:
-                            description: Separator is the string between concatenated
-                              SourceLabels.
-                            type: string
-                          sourceLabels:
-                            description: The source labels select values from existing
-                              labels. Their content is concatenated using the configured
-                              Separator and matched against the configured regular
-                              expression.
-                            items:
-                              description: LabelName is a valid Prometheus label name
-                                which may only contain ASCII letters, numbers, as
-                                well as underscores.
-                              pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$
-                              type: string
-                            type: array
-                          targetLabel:
-                            description: "Label to which the resulting string is written
-                              in a replacement. \n It is mandatory for `Replace`,
-                              `HashMod`, `Lowercase`, `Uppercase`, `KeepEqual` and
-                              `DropEqual` actions. \n Regex capture groups are available."
-                            type: string
-                        type: object
-                      type: array
-                    scheme:
-                      description: HTTP scheme to use for scraping. `http` and `https`
-                        are the expected values unless you rewrite the `__scheme__`
-                        label via relabeling. If empty, Prometheus uses the default
-                        value `http`.
-                      enum:
-                      - http
-                      - https
-                      type: string
-                    scrapeTimeout:
-                      description: Timeout after which the scrape is ended If not
-                        specified, the Prometheus global scrape timeout is used unless
-                        it is less than `Interval` in which the latter is used.
-                      pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$
-                      type: string
-                    targetPort:
-                      anyOf:
-                      - type: integer
-                      - type: string
-                      description: Name or number of the target port of the Pod behind
-                        the Service, the port must be specified with container port
-                        property. Mutually exclusive with port.
-                      x-kubernetes-int-or-string: true
-                    tlsConfig:
-                      description: TLS configuration to use when scraping the endpoint
-                      properties:
-                        ca:
-                          description: Certificate authority used when verifying server
-                            certificates.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    TODO: Add other useful fields. apiVersion, kind,
-                                    uid?'
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    TODO: Add other useful fields. apiVersion, kind,
-                                    uid?'
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        caFile:
-                          description: Path to the CA cert in the Prometheus container
-                            to use for the targets.
-                          type: string
-                        cert:
-                          description: Client certificate to present when doing client-authentication.
-                          properties:
-                            configMap:
-                              description: ConfigMap containing data to use for the
-                                targets.
-                              properties:
-                                key:
-                                  description: The key to select.
-                                  type: string
-                                name:
-                                  description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    TODO: Add other useful fields. apiVersion, kind,
-                                    uid?'
-                                  type: string
-                                optional:
-                                  description: Specify whether the ConfigMap or its
-                                    key must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                            secret:
-                              description: Secret containing data to use for the targets.
-                              properties:
-                                key:
-                                  description: The key of the secret to select from.  Must
-                                    be a valid secret key.
-                                  type: string
-                                name:
-                                  description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                    TODO: Add other useful fields. apiVersion, kind,
-                                    uid?'
-                                  type: string
-                                optional:
-                                  description: Specify whether the Secret or its key
-                                    must be defined
-                                  type: boolean
-                              required:
-                              - key
-                              type: object
-                              x-kubernetes-map-type: atomic
-                          type: object
-                        certFile:
-                          description: Path to the client cert file in the Prometheus
-                            container for the targets.
-                          type: string
-                        insecureSkipVerify:
-                          description: Disable target certificate validation.
-                          type: boolean
-                        keyFile:
-                          description: Path to the client key file in the Prometheus
-                            container for the targets.
-                          type: string
-                        keySecret:
-                          description: Secret containing the client key file for the
-                            targets.
-                          properties:
-                            key:
-                              description: The key of the secret to select from.  Must
-                                be a valid secret key.
-                              type: string
-                            name:
-                              description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
-                                TODO: Add other useful fields. apiVersion, kind, uid?'
-                              type: string
-                            optional:
-                              description: Specify whether the Secret or its key must
-                                be defined
-                              type: boolean
-                          required:
-                          - key
-                          type: object
-                          x-kubernetes-map-type: atomic
-                        serverName:
-                          description: Used to verify the hostname for the targets.
-                          type: string
-                      type: object
-                  type: object
-                type: array
-              jobLabel:
-                description: "JobLabel selects the label from the associated Kubernetes
-                  service which will be used as the `job` label for all metrics. \n
-                  For example: If in `ServiceMonitor.spec.jobLabel: foo` and in `Service.metadata.labels.foo:
-                  bar`, then the `job=\"bar\"` label is added to all metrics. \n If
-                  the value of this field is empty or if the label doesn't exist for
-                  the given Service, the `job` label of the metrics defaults to the
-                  name of the Kubernetes Service."
-                type: string
-              labelLimit:
-                description: Per-scrape limit on number of labels that will be accepted
-                  for a sample. Only valid in Prometheus versions 2.27.0 and newer.
-                format: int64
-                type: integer
-              labelNameLengthLimit:
-                description: Per-scrape limit on length of labels name that will be
-                  accepted for a sample. Only valid in Prometheus versions 2.27.0
-                  and newer.
-                format: int64
-                type: integer
-              labelValueLengthLimit:
-                description: Per-scrape limit on length of labels value that will
-                  be accepted for a sample. Only valid in Prometheus versions 2.27.0
-                  and newer.
-                format: int64
-                type: integer
-              namespaceSelector:
-                description: Selector to select which namespaces the Kubernetes Endpoints
-                  objects are discovered from.
-                properties:
-                  any:
-                    description: Boolean describing whether all namespaces are selected
-                      in contrast to a list restricting them.
-                    type: boolean
-                  matchNames:
-                    description: List of namespace names to select from.
-                    items:
-                      type: string
-                    type: array
-                type: object
-              podTargetLabels:
-                description: PodTargetLabels transfers labels on the Kubernetes `Pod`
-                  onto the created metrics.
-                items:
-                  type: string
-                type: array
-              sampleLimit:
-                description: SampleLimit defines per-scrape limit on number of scraped
-                  samples that will be accepted.
-                format: int64
-                type: integer
-              selector:
-                description: Selector to select Endpoints objects.
-                properties:
-                  matchExpressions:
-                    description: matchExpressions is a list of label selector requirements.
-                      The requirements are ANDed.
-                    items:
-                      description: A label selector requirement is a selector that
-                        contains values, a key, and an operator that relates the key
-                        and values.
-                      properties:
-                        key:
-                          description: key is the label key that the selector applies
-                            to.
-                          type: string
-                        operator:
-                          description: operator represents a key's relationship to
-                            a set of values. Valid operators are In, NotIn, Exists
-                            and DoesNotExist.
-                          type: string
-                        values:
-                          description: values is an array of string values. If the
-                            operator is In or NotIn, the values array must be non-empty.
-                            If the operator is Exists or DoesNotExist, the values
-                            array must be empty. This array is replaced during a strategic
-                            merge patch.
-                          items:
-                            type: string
-                          type: array
-                      required:
-                      - key
-                      - operator
-                      type: object
-                    type: array
-                  matchLabels:
-                    additionalProperties:
-                      type: string
-                    description: matchLabels is a map of {key,value} pairs. A single
-                      {key,value} in the matchLabels map is equivalent to an element
-                      of matchExpressions, whose key field is "key", the operator
-                      is "In", and the values array contains only "value". The requirements
-                      are ANDed.
-                    type: object
-                type: object
-                x-kubernetes-map-type: atomic
-              targetLabels:
-                description: TargetLabels transfers labels from the Kubernetes `Service`
-                  onto the created metrics.
-                items:
-                  type: string
-                type: array
-              targetLimit:
-                description: TargetLimit defines a limit on the number of scraped
-                  targets that will be accepted.
-                format: int64
-                type: integer
-            required:
-            - endpoints
-            - selector
-            type: object
-        required:
-        - spec
-        type: object
-    served: true
-    storage: true

packages/system/victoria-metrics-operator/charts/prometheus-operator-crds/values.yaml

@@ -1,3 +1,4 @@
 ## Annotations for CRDs
 ##
-annotations: {}
+crds:
+  annotations: {}

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/CHANGELOG.md

@@ -2,13 +2,454 @@
 
 ## Next release
 
-**Release date:** TBD
+- TODO
 
-![AppVersion: **APP_VERSION**](https://img.shields.io/static/v1?label=AppVersion&message=**APP_VERSION**&color=success&logo=)
+## 0.34.5
+
+**Release date:** 2024-08-26
+
+![AppVersion: v0.47.2](https://img.shields.io/static/v1?label=AppVersion&message=v0.47.2&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- fixes typo at clean webhook. vmlogs->vlogs.
+
+## 0.34.4
+
+**Release date:** 2024-08-26
+
+![AppVersion: v0.47.2](https://img.shields.io/static/v1?label=AppVersion&message=v0.47.2&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- fixes RBAC by rollback <https://github.com/VictoriaMetrics/helm-charts/commit/7d75b93525bb0a99a8011b700d0a51b6b762321c>
+
+## 0.34.3
+
+**Release date:** 2024-08-26
+
+![AppVersion: v0.47.2](https://img.shields.io/static/v1?label=AppVersion&message=v0.47.2&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- removes not implemented scrape CRDs from validation webhook
+
+## 0.34.2
+
+**Release date:** 2024-08-26
+
+![AppVersion: v0.47.2](https://img.shields.io/static/v1?label=AppVersion&message=v0.47.2&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- set `admissionWebhooks.keepTLSSecret` to `true` by default
+- fixed indent, for Issuer crd, when `cert-manager.enabled: true`
+- updates operator to [v0.47.2](https://github.com/VictoriaMetrics/operator/releases/tag/v0.47.2) version
+
+## 0.34.1
+
+**Release date:** 2024-08-23
+
+![AppVersion: v0.47.1](https://img.shields.io/static/v1?label=AppVersion&message=v0.47.1&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+**Update note**: main container name was changed to `operator`, which will recreate a pod.
+
+- Updated operator to v0.47.1 release
+- Added global imagePullSecrets and image.registry
+- Use static container names in a pod
+- Updated operator service scrape config
+- Added `.Values.vmstorage.service.ipFamilies` and `.Values.vmstorage.service.ipFamilyPolicy` for service IP family management
+- Enabled webhook by default
+- Generate webhook certificate when Cert Manager is not enabled
+- Added ability to configure container port
+- Fixed image pull secrets. See [this issue](https://github.com/VictoriaMetrics/helm-charts/issues/1285)
+
+## 0.34.0
+
+**Release date:** 2024-08-15
+
+![AppVersion: v0.47.0](https://img.shields.io/static/v1?label=AppVersion&message=v0.47.0&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- Set minimal kubernetes version to 1.25
+- Removed support for policy/v1beta1/PodDisruptionBudget
+- Added configurable probes at `.Values.probe`
+- updates operator to [v0.47.0](https://github.com/VictoriaMetrics/operator/releases/tag/v0.47.0) release
+- adds RBAC permissions to VLogs object
+
+## 0.33.6
+
+**Release date:** 2024-08-07
+
+![AppVersion: v0.46.4](https://img.shields.io/static/v1?label=AppVersion&message=v0.46.4&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- add missing permission to allow patching `horizontalpodautoscalers` when operator watches single namespace.
+
+## 0.33.5
+
+**Release date:** 2024-08-01
+
+![AppVersion: v0.46.4](https://img.shields.io/static/v1?label=AppVersion&message=v0.46.4&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- fix cleanup job image tag when `.Capabilities.KubeVersion.Minor` returns version with plus sign. See [this pull request](https://github.com/VictoriaMetrics/helm-charts/pull/1169) by @dimaslv.
+
+## 0.33.4
+
+**Release date:** 2024-07-10
+
+![AppVersion: v0.46.4](https://img.shields.io/static/v1?label=AppVersion&message=v0.46.4&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- updates operator to [v0.46.4](https://github.com/VictoriaMetrics/operator/releases/tag/v0.46.4) release
+
+## 0.33.3
+
+**Release date:** 2024-07-05
+
+![AppVersion: v0.46.3](https://img.shields.io/static/v1?label=AppVersion&message=v0.46.3&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- updates operator to [v0.46.3](https://github.com/VictoriaMetrics/operator/releases/tag/v0.46.3) release
+
+## 0.33.2
+
+**Release date:** 2024-07-04
+
+![AppVersion: v0.46.2](https://img.shields.io/static/v1?label=AppVersion&message=v0.46.2&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- breaking change: operator uses different entrypoint, remove `command` entrypoint
+- breaking change: operator uses new flag for leader election `leader-elect`
+- removes podsecurity policy. It's longer supported by kubernetes
+- updates operator to [v0.46.2](https://github.com/VictoriaMetrics/operator/releases/tag/v0.46.2) release
+
+## 0.33.1
+
+**Release date:** 2024-07-03
+
+![AppVersion: v0.46.0](https://img.shields.io/static/v1?label=AppVersion&message=v0.46.0&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- breaking change: operator uses different entrypoint, remove `command` entrypoint
+- breaking change: operator uses new flag for leader election `leader-elect`
+- removes podsecurity policy. It's longer supported by kubernetes
+- updates operator to [v0.46.0](https://github.com/VictoriaMetrics/operator/releases/tag/v0.46.0) release
+
+## 0.32.3
+
+**Release date:** 2024-07-02
+
+![AppVersion: v0.45.0](https://img.shields.io/static/v1?label=AppVersion&message=v0.45.0&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- use bitnami/kubectl image for cleanup instead of deprecated gcr.io/google_containers/hyperkube
+
+## 0.32.2
+
+**Release date:** 2024-06-14
+
+![AppVersion: v0.45.0](https://img.shields.io/static/v1?label=AppVersion&message=v0.45.0&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- fix default image tag when using `Chart.AppVersion`, previously the version is missing "v".
+
+## 0.32.1
+
+**Release date:** 2024-06-14
+
+![AppVersion: 0.45.0](https://img.shields.io/static/v1?label=AppVersion&message=0.45.0&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+**Update note**: The VictoriaMetrics components image tag template has been updated. This change introduces `.Values.<component>.image.variant` to specify tag suffixes like `-scratch`, `-cluster`, `-enterprise`. Additionally, you can now omit `.Values.<component>.image.tag` to automatically use the version specified in `.Chart.AppVersion`.
+
+- support specifying image tag suffix like "-enterprise" for VictoriaMetrics components using `.Values.<component>.image.variant`.
+
+## 0.32.0
+
+**Release date:** 2024-06-10
+
+![AppVersion: 0.45.0](https://img.shields.io/static/v1?label=AppVersion&message=0.45.0&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- updates operator to [v0.45.0](https://github.com/VictoriaMetrics/operator/releases/tag/v0.45.0)
+
+## 0.31.2
+
+**Release date:** 2024-05-14
+
+![AppVersion: 0.44.0](https://img.shields.io/static/v1?label=AppVersion&message=0.44.0&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- fix missing serviceaccounts patch permission in ClusterRole, see [this issue](https://github.com/VictoriaMetrics/helm-charts/issues/1012) for details.
+
+## 0.31.1
+
+**Release date:** 2024-05-10
+
+![AppVersion: 0.44.0](https://img.shields.io/static/v1?label=AppVersion&message=0.44.0&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- fix serviceAccount template when `.Values.serviceAccount.create=false`, see this [pull request](https://github.com/VictoriaMetrics/helm-charts/pull/1002) by @tylerturk for details.
+- support creating aggregated clusterRoles for VM CRDs with admin and read permissions, see this [pull request](https://github.com/VictoriaMetrics/helm-charts/pull/996) by @reegnz for details.
+
+## 0.31.0
+
+**Release date:** 2024-05-09
+
+![AppVersion: 0.44.0](https://img.shields.io/static/v1?label=AppVersion&message=0.44.0&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- updates operator to [v0.44.0](https://github.com/VictoriaMetrics/operator/releases/tag/v0.44.0)
+
+## 0.30.3
+
+**Release date:** 2024-04-26
+
+![AppVersion: 0.43.5](https://img.shields.io/static/v1?label=AppVersion&message=0.43.5&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- updates operator to [v0.43.5](https://github.com/VictoriaMetrics/operator/releases/tag/v0.43.5)
+
+## 0.30.2
+
+**Release date:** 2024-04-23
+
+![AppVersion: 0.43.3](https://img.shields.io/static/v1?label=AppVersion&message=0.43.3&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- updates operator to v0.43.1 version
+- fixes typo at single-namespace role for `vmscrapeconfig`. See this [issue](https://github.com/VictoriaMetrics/helm-charts/issues/987) for details.
+
+## 0.30.1
+
+**Release date:** 2024-04-18
+
+![AppVersion: 0.43.1](https://img.shields.io/static/v1?label=AppVersion&message=0.43.1&color=success&logo=)
 ![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
 
 - TODO
 
+- updates operator to v0.43.1 version
+
+## 0.30.0
+
+**Release date:** 2024-04-18
+
+![AppVersion: 0.43.0](https://img.shields.io/static/v1?label=AppVersion&message=0.43.0&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- updates operator to v0.43.0-0 version
+- adds `events` create permission
+- properly truncate value of `app.kubernetes.io/managed-by` and `app.kubernetes.io/instance` labels in case release name exceeds 63 characters.
+
+## 0.29.6
+
+**Release date:** 2024-04-16
+
+![AppVersion: 0.42.4](https://img.shields.io/static/v1?label=AppVersion&message=0.42.4&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- clean up vmauth as well when uninstall chart with `cleanupCRD: true`, since it also has `finalizers`.
+- sync new crd VMScrapeConfig from operator, see detail in <https://docs.victoriametrics.com/operator/api/#vmscrapeconfig>.
+
+## 0.29.5
+
+**Release date:** 2024-04-02
+
+![AppVersion: 0.42.4](https://img.shields.io/static/v1?label=AppVersion&message=0.42.4&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- bump version of VM operator to [0.42.4](https://github.com/VictoriaMetrics/operator/releases/tag/v0.42.4)
+
+## 0.29.4
+
+**Release date:** 2024-03-28
+
+![AppVersion: 0.42.3](https://img.shields.io/static/v1?label=AppVersion&message=0.42.3&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- added ability to use slice variables in extraArgs (#944)
+
+## 0.29.3
+
+**Release date:** 2024-03-12
+
+![AppVersion: 0.42.3](https://img.shields.io/static/v1?label=AppVersion&message=0.42.3&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- TODO
+
+## 0.29.2
+
+**Release date:** 2024-03-06
+
+![AppVersion: 0.42.2](https://img.shields.io/static/v1?label=AppVersion&message=0.42.2&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- bump version of VM operator to [0.42.2](https://github.com/VictoriaMetrics/operator/releases/tag/v0.42.2)
+
+## 0.29.0
+
+**Release date:** 2024-03-06
+
+![AppVersion: 0.42.1](https://img.shields.io/static/v1?label=AppVersion&message=0.42.0&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- bump version of VM operator to [0.42.1](https://github.com/VictoriaMetrics/operator/releases/tag/v0.42.1)
+
+## 0.29.0
+
+**Release date:** 2024-03-04
+
+![AppVersion: 0.42.0](https://img.shields.io/static/v1?label=AppVersion&message=0.42.0&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- bump version of VM operator to [0.42.0](https://github.com/VictoriaMetrics/operator/releases/tag/v0.42.0)
+
+## 0.28.1
+
+**Release date:** 2024-02-21
+
+![AppVersion: 0.41.2](https://img.shields.io/static/v1?label=AppVersion&message=0.41.2&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- bump version of VM operator to [0.41.2](https://github.com/VictoriaMetrics/operator/releases/tag/v0.41.2)
+
+## 0.28.0
+
+**Release date:** 2024-02-09
+
+![AppVersion: 0.41.1](https://img.shields.io/static/v1?label=AppVersion&message=0.41.1&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- Update victoriametrics CRD resources yaml.
+
+## 0.27.11
+
+**Release date:** 2024-02-01
+
+![AppVersion: 0.41.1](https://img.shields.io/static/v1?label=AppVersion&message=0.41.1&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- bump version of VM operator to [0.41.1](https://github.com/VictoriaMetrics/operator/releases/tag/v0.41.1)
+
+## 0.27.10
+
+**Release date:** 2024-01-24
+
+![AppVersion: 0.40.0](https://img.shields.io/static/v1?label=AppVersion&message=0.40.0&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- Bump operator version to [0.40.0](https://github.com/VictoriaMetrics/operator/releases/tag/v0.40.0)
+
+## 0.27.9
+
+**Release date:** 2023-12-12
+
+![AppVersion: 0.39.4](https://img.shields.io/static/v1?label=AppVersion&message=0.39.4&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- bump version of VM operator to [0.39.4](https://github.com/VictoriaMetrics/operator/releases/tag/v0.39.4)
+
+## 0.27.8
+
+**Release date:** 2023-12-08
+
+![AppVersion: 0.39.3](https://img.shields.io/static/v1?label=AppVersion&message=0.39.3&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- Sync CRD resources with operator [v0.39.3](https://github.com/VictoriaMetrics/operator/releases/tag/v0.39.3).
+
+## 0.27.7
+
+**Release date:** 2023-12-08
+
+![AppVersion: 0.39.3](https://img.shields.io/static/v1?label=AppVersion&message=0.39.3&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- Skip deleting victoriametrics CRD resources when uninstall release.
+
+## 0.27.6
+
+**Release date:** 2023-11-16
+
+![AppVersion: 0.39.3](https://img.shields.io/static/v1?label=AppVersion&message=0.39.3&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- bump version of VM operator to [0.39.3](https://github.com/VictoriaMetrics/operator/releases/tag/v0.39.3)
+
+## 0.27.5
+
+**Release date:** 2023-11-15
+
+![AppVersion: 0.39.2](https://img.shields.io/static/v1?label=AppVersion&message=0.39.2&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- bump version of VM operator to [0.39.2](https://github.com/VictoriaMetrics/operator/releases/tag/v0.39.2)
+- Add `extraObjects` to allow deploying additional resources with the chart release. (#751)
+
+## 0.27.4
+
+**Release date:** 2023-11-01
+
+![AppVersion: 0.39.1](https://img.shields.io/static/v1?label=AppVersion&message=0.39.1&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- bump version of VM operator to [0.39.1](https://github.com/VictoriaMetrics/operator/releases/tag/v0.39.1)
+
+## 0.27.3
+
+**Release date:** 2023-10-08
+
+![AppVersion: 0.39.0](https://img.shields.io/static/v1?label=AppVersion&message=0.39.0&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- Added endpointslices permissions to operator roles (#708)
+
+## 0.27.2
+
+**Release date:** 2023-10-04
+
+![AppVersion: 0.39.0](https://img.shields.io/static/v1?label=AppVersion&message=0.39.0&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- bump version of VM operator to [0.39.0](https://github.com/VictoriaMetrics/operator/releases/tag/v0.39.0)
+
+## 0.27.1
+
+**Release date:** 2023-09-28
+
+![AppVersion: 0.38.0](https://img.shields.io/static/v1?label=AppVersion&message=0.38.0&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- Fix `relabelConfigs` for operator's VMServiceScrape (#624)
+
+## 0.27.0
+
+**Release date:** 2023-09-11
+
+![AppVersion: 0.38.0](https://img.shields.io/static/v1?label=AppVersion&message=0.38.0&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- Bump version of operator to [v0.38.0](https://github.com/VictoriaMetrics/operator/releases/tag/v0.38.0)
+
+## 0.26.2
+
+**Release date:** 2023-09-07
+
+![AppVersion: 0.37.1](https://img.shields.io/static/v1?label=AppVersion&message=0.37.1&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- Updated CRDs for operator
+
+## 0.26.1
+
+**Release date:** 2023-09-04
+
+![AppVersion: 0.37.1](https://img.shields.io/static/v1?label=AppVersion&message=0.37.1&color=success&logo=)
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- Bump version of Victoria Metrics operator to `v0.37.1`
+
 ## 0.26.0
 
 **Release date:** 2023-08-30
@@ -26,11 +467,11 @@
 ![AppVersion: 0.36.0](https://img.shields.io/static/v1?label=AppVersion&message=0.36.0&color=success&logo=)
 ![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
 
-* Added `topologySpreadConstraints` for the operator + a small refactoring (#611)
-* Fix vm operator appVersion (#589)
-* Fixes operator doc description
-* Add `cleanupCRD` option to clean up vm cr resources when uninstalling (#593)
-* Bump operator version to [v0.36.0](https://github.com/VictoriaMetrics/operator/releases/tag/v0.36.0)
+- Added `topologySpreadConstraints` for the operator + a small refactoring (#611)
+- Fix vm operator appVersion (#589)
+- Fixes operator doc description
+- Add `cleanupCRD` option to clean up vm cr resources when uninstalling (#593)
+- Bump operator version to [v0.36.0](https://github.com/VictoriaMetrics/operator/releases/tag/v0.36.0)
 
 ## 0.24.1
 
@@ -39,7 +480,7 @@
 ![AppVersion: 0.35.](https://img.shields.io/static/v1?label=AppVersion&message=0.35.&color=success&logo=)
 ![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
 
-* operator release v0.35.1
+- operator release v0.35.1
 
 ## 0.24.0
 
@@ -48,8 +489,8 @@
 ![AppVersion: 0.35.0](https://img.shields.io/static/v1?label=AppVersion&message=0.35.0&color=success&logo=)
 ![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
 
-* updates operator for v0.35.0
-* updates for v1.91.1 release
+- updates operator for v0.35.0
+- updates for v1.91.1 release
 
 ## 0.23.1
 
@@ -58,7 +499,7 @@
 ![AppVersion: 0.34.1](https://img.shields.io/static/v1?label=AppVersion&message=0.34.1&color=success&logo=)
 ![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
 
-* updates operator for v0.34.1 version
+- updates operator for v0.34.1 version
 
 ## 0.23.0
 
@@ -67,5 +508,5 @@
 ![AppVersion: 0.34.0](https://img.shields.io/static/v1?label=AppVersion&message=0.34.0&color=success&logo=)
 ![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
 
-* bump operator version
-* feat(operator): add PodDisruptionBudget (#546)
+- bump operator version
+- feat(operator): add PodDisruptionBudget (#546)

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: victoria-metrics-common
+  repository: https://victoriametrics.github.io/helm-charts
+  version: 0.0.5
+digest: sha256:ce44687129fac535892755448670b7a689902b591fb9392a77e8438bd8ff742d
+generated: "2024-08-26T16:30:15.503668983+04:00"

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/Chart.yaml

@@ -1,13 +1,7 @@
 annotations:
   artifacthub.io/category: monitoring-logging
-  artifacthub.io/changes: |-
-    **Release date:** 2023-08-30
-
-    ![AppVersion: 0.37.0](https://img.shields.io/static/v1?label=AppVersion&message=0.37.0&color=success&logo=)
-    ![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
-
-    - Bump operator version to [v0.37.0](https://github.com/VictoriaMetrics/operator/releases/tag/v0.37.0)
-    - `psp_auto_creation_enabled` for operator is disabled by default
+  artifacthub.io/changes: |
+    - fixes typo at clean webhook. vmlogs->vlogs.
   artifacthub.io/license: Apache-2.0
   artifacthub.io/links: |
     - name: Sources
@@ -17,8 +11,12 @@ annotations:
     - name: Docs
       url: https://docs.victoriametrics.com/operator
   artifacthub.io/operator: "true"
-apiVersion: v1
-appVersion: 0.37.0
+apiVersion: v2
+appVersion: v0.47.2
+dependencies:
+- name: victoria-metrics-common
+  repository: https://victoriametrics.github.io/helm-charts
+  version: 0.0.*
 description: Victoria Metrics Operator
 home: https://github.com/VictoriaMetrics/operator
 icon: https://avatars.githubusercontent.com/u/43720803?s=200&v=4
@@ -32,9 +30,10 @@ keywords:
 - metrics
 - metricsql
 - timeseries
-kubeVersion: '>=1.23.0-0'
+kubeVersion: '>=1.25.0-0'
 name: victoria-metrics-operator
 sources:
 - https://github.com/VictoriaMetrics/helm-charts
 - https://github.com/VictoriaMetrics/operator
-version: 0.26.0
+type: application
+version: 0.34.5

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/README.md

@@ -1,7 +1,7 @@
 # Helm Chart For Victoria Metrics Operator.
 
- ![Version: 0.26.0](https://img.shields.io/badge/Version-0.26.0-informational?style=flat-square)
-[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/victoriametrics)](https://artifacthub.io/packages/helm/victoriametrics/victoria-logs-operator)
+![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)  ![Version: 0.34.5](https://img.shields.io/badge/Version-0.34.5-informational?style=flat-square)
+[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/victoriametrics)](https://artifacthub.io/packages/helm/victoriametrics/victoria-metrics-operator)
 
 Victoria Metrics Operator
 
@@ -10,6 +10,38 @@ Victoria Metrics Operator
 * Install the follow packages: ``git``, ``kubectl``, ``helm``, ``helm-docs``. See this [tutorial](../../REQUIREMENTS.md).
 * PV support on underlying infrastructure.
 
+## ArgoCD issues
+
+When running operator using ArgoCD without Cert Manager (`.Values.admissionWebhooks.certManager.enabled: false`) it will rerender webhook certificates
+on each sync since Helm `lookup` function is not respected by ArgoCD. To prevent this please update you operator Application `spec.syncPolicy` and `spec.ignoreDifferences` with a following:
+
+```yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+...
+spec:
+  ...
+  syncPolicy:
+    syncOptions:
+    # https://argo-cd.readthedocs.io/en/stable/user-guide/sync-options/#respect-ignore-difference-configs
+    # argocd must also ignore difference during apply stage
+    # otherwise it ll silently override changes and cause a problem
+    - RespectIgnoreDifferences=true
+  ignoreDifferences:
+    - group: ""
+      kind: Secret
+      name: <fullname>-validation
+      namespace: kube-system
+      jsonPointers:
+        - /data
+    - group: admissionregistration.k8s.io
+      kind: ValidatingWebhookConfiguration
+      name: <fullname>-admission
+      jqPathExpressions:
+      - '.webhooks[]?.clientConfig.caBundle'
+```
+where `<fullname>` is output of `{{ include "vm-operator.fullname" }}` for your setup
+
 ## Upgrade guide
 
  During release an issue with helm CRD was discovered. So for upgrade from version less then 0.1.3 you have to two options:
@@ -139,30 +171,36 @@ Change the values according to the need of the environment in ``victoria-metrics
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| admissionWebhooks | object | `{"caBundle":"","certManager":{"enabled":false,"issuer":{}},"enabled":false,"enabledCRDValidation":{"vmagent":true,"vmalert":true,"vmalertmanager":true,"vmalertmanagerConfig":true,"vmauth":true,"vmcluster":true,"vmrule":true,"vmsingle":true,"vmuser":true},"policy":"Fail"}` | Configures resource validation |
-| admissionWebhooks.caBundle | string | `""` | with keys: tls.key, tls.crt, ca.crt |
+| admissionWebhooks | object | `{"certManager":{"enabled":false,"issuer":{}},"enabled":true,"enabledCRDValidation":{"vlogs":true,"vmagent":true,"vmalert":true,"vmalertmanager":true,"vmalertmanagerconfig":true,"vmauth":true,"vmcluster":true,"vmrule":true,"vmsingle":true,"vmuser":true},"keepTLSSecret":true,"policy":"Fail","tls":{"caCert":null,"cert":null,"key":null}}` | Configures resource validation |
+| admissionWebhooks.certManager | object | `{"enabled":false,"issuer":{}}` | with keys: tls.key, tls.crt, ca.crt |
 | admissionWebhooks.certManager.enabled | bool | `false` | Enables cert creation and injection by cert-manager. |
 | admissionWebhooks.certManager.issuer | object | `{}` | If needed, provide own issuer. Operator will create self-signed if empty. |
-| admissionWebhooks.enabled | bool | `false` | Enables validation webhook. |
+| admissionWebhooks.enabled | bool | `true` | Enables validation webhook. |
 | admissionWebhooks.policy | string | `"Fail"` | What to do in case, when operator not available to validate request. |
 | affinity | object | `{}` | Pod affinity |
 | annotations | object | `{}` | Annotations to be added to the all resources |
-| cleanupCRD | bool | `false` | Tells helm to clean up vm cr resources when uninstalling |
+| cleanupCRD | bool | `false` | Tells helm to clean up all the vm resources under this release's namespace when uninstalling |
 | cleanupImage.pullPolicy | string | `"IfNotPresent"` |  |
-| cleanupImage.repository | string | `"gcr.io/google_containers/hyperkube"` |  |
-| cleanupImage.tag | string | `"v1.18.0"` |  |
+| cleanupImage.repository | string | `"bitnami/kubectl"` |  |
 | createCRD | bool | `true` | with this option, if you remove this chart, all crd resources will be deleted with it. |
 | env | list | `[]` | extra settings for the operator deployment. full list Ref: [https://github.com/VictoriaMetrics/operator/blob/master/vars.MD](https://github.com/VictoriaMetrics/operator/blob/master/vars.MD) |
+| envFrom | list | `[]` |  |
 | extraArgs | object | `{}` | operator container additional commandline arguments |
 | extraContainers | list | `[]` |  |
 | extraHostPathMounts | list | `[]` | Additional hostPath mounts |
 | extraLabels | object | `{}` | Labels to be added to the all resources |
+| extraObjects | list | `[]` | Add extra specs dynamically to this chart |
 | extraVolumeMounts | list | `[]` | Extra Volume Mounts for the container |
 | extraVolumes | list | `[]` | Extra Volumes for the pod |
 | fullnameOverride | string | `""` | Overrides the full name of server component |
+| global.cluster.dnsDomain | string | `"cluster.local"` |  |
+| global.image.registry | string | `""` |  |
+| global.imagePullSecrets | list | `[]` |  |
 | image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
+| image.registry | string | `""` | Image registry |
 | image.repository | string | `"victoriametrics/operator"` | Image repository |
-| image.tag | string | `"v0.37.0"` | Image tag |
+| image.tag | string | `""` | Image tag override Chart.AppVersion |
+| image.variant | string | `""` |  |
 | imagePullSecrets | list | `[]` | Secret to pull images |
 | logLevel | string | `"info"` | possible values: info and error. |
 | nameOverride | string | `""` | VM operatror deployment name override |
@@ -170,20 +208,44 @@ Change the values according to the need of the environment in ``victoria-metrics
 | operator.disable_prometheus_converter | bool | `false` | By default, operator converts prometheus-operator objects. |
 | operator.enable_converter_ownership | bool | `false` | Enables ownership reference for converted prometheus-operator objects, it will remove corresponding victoria-metrics objects in case of deletion prometheus one. |
 | operator.prometheus_converter_add_argocd_ignore_annotations | bool | `false` | Compare-options and sync-options for prometheus objects converted by operator for properly use with ArgoCD |
-| operator.psp_auto_creation_enabled | bool | `false` | By default, operator doesn't create psp for its objects. |
 | operator.useCustomConfigReloader | bool | `false` | Enables custom config-reloader, bundled with operator. It should reduce  vmagent and vmauth config sync-time and make it predictable. |
 | podDisruptionBudget.enabled | bool | `false` |  |
 | podDisruptionBudget.labels | object | `{}` |  |
 | podLabels | object | `{}` |  |
 | podSecurityContext | object | `{}` |  |
+| probe.liveness.failureThreshold | int | `3` |  |
+| probe.liveness.initialDelaySeconds | int | `5` |  |
+| probe.liveness.periodSeconds | int | `15` |  |
+| probe.liveness.tcpSocket.port | string | `"probe"` |  |
+| probe.liveness.timeoutSeconds | int | `5` |  |
+| probe.readiness.failureThreshold | int | `3` |  |
+| probe.readiness.httpGet.path | string | `"{{ include \"vm.probe.http.path\" . }}"` |  |
+| probe.readiness.httpGet.port | string | `"probe"` |  |
+| probe.readiness.httpGet.scheme | string | `"{{ include \"vm.probe.http.scheme\" . }}"` |  |
+| probe.readiness.initialDelaySeconds | int | `5` |  |
+| probe.readiness.periodSeconds | int | `15` |  |
+| probe.readiness.timeoutSeconds | int | `5` |  |
+| probe.startup | object | `{}` |  |
+| rbac.aggregatedClusterRoles | object | `{"enabled":true,"labels":{"admin":{"rbac.authorization.k8s.io/aggregate-to-admin":"true"},"view":{"rbac.authorization.k8s.io/aggregate-to-view":"true"}}}` | create aggregated clusterRoles for CRD readonly and admin permissions |
+| rbac.aggregatedClusterRoles.labels | object | `{"admin":{"rbac.authorization.k8s.io/aggregate-to-admin":"true"},"view":{"rbac.authorization.k8s.io/aggregate-to-view":"true"}}` | labels attached to according clusterRole |
 | rbac.create | bool | `true` | Specifies whether the RBAC resources should be created |
-| rbac.pspEnabled | bool | `true` |  |
 | replicaCount | int | `1` |  |
 | resources | object | `{}` | Resource object |
 | securityContext | object | `{}` |  |
+| service.annotations | object | `{}` |  |
+| service.clusterIP | string | `""` |  |
+| service.externalIPs | string | `""` |  |
+| service.externalTrafficPolicy | string | `""` |  |
+| service.healthCheckNodePort | string | `""` |  |
+| service.ipFamilies | list | `[]` |  |
+| service.ipFamilyPolicy | string | `""` |  |
+| service.labels | object | `{}` |  |
+| service.loadBalancerIP | string | `""` |  |
+| service.loadBalancerSourceRanges | list | `[]` |  |
+| service.type | string | `"ClusterIP"` |  |
 | serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
 | serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
-| serviceMonitor | object | `{"annotations":{},"enabled":false,"extraLabels":{},"relabelings":[]}` | configures monitoring with serviceScrape. VMServiceScrape must be pre-installed |
+| serviceMonitor | object | `{"annotations":{},"basicAuth":{},"enabled":false,"extraLabels":{},"interval":"","relabelings":[],"scheme":"","scrapeTimeout":"","tlsConfig":{}}` | configures monitoring with serviceScrape. VMServiceScrape must be pre-installed |
 | tolerations | list | `[]` | Array of tolerations object. Ref: [https://kubernetes.io/docs/concepts/configuration/assign-pod-node/](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/) |
 | topologySpreadConstraints | list | `[]` | Pod Topology Spread Constraints. Ref: [https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/) |
-| watchNamespace | string | `""` |  |
+| watchNamespace | string | `""` |  |

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/README.md.gotmpl

@@ -1,7 +1,7 @@
 # Helm Chart For Victoria Metrics Operator.
 
 {{ template "chart.typeBadge" . }} {{ template "chart.versionBadge" . }}
-[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/victoriametrics)](https://artifacthub.io/packages/helm/victoriametrics/victoria-logs-operator)
+[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/victoriametrics)](https://artifacthub.io/packages/helm/victoriametrics/victoria-metrics-operator)
 
 {{ template "chart.description" . }}
 
@@ -10,6 +10,38 @@
 * Install the follow packages: ``git``, ``kubectl``, ``helm``, ``helm-docs``. See this [tutorial](../../REQUIREMENTS.md).
 * PV support on underlying infrastructure.
 
+## ArgoCD issues
+
+When running operator using ArgoCD without Cert Manager (`.Values.admissionWebhooks.certManager.enabled: false`) it will rerender webhook certificates
+on each sync since Helm `lookup` function is not respected by ArgoCD. To prevent this please update you operator Application `spec.syncPolicy` and `spec.ignoreDifferences` with a following:
+
+```yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+...
+spec:
+  ...
+  syncPolicy:
+    syncOptions:
+    # https://argo-cd.readthedocs.io/en/stable/user-guide/sync-options/#respect-ignore-difference-configs
+    # argocd must also ignore difference during apply stage
+    # otherwise it ll silently override changes and cause a problem
+    - RespectIgnoreDifferences=true
+  ignoreDifferences:
+    - group: ""
+      kind: Secret
+      name: <fullname>-validation
+      namespace: kube-system
+      jsonPointers:
+        - /data
+    - group: admissionregistration.k8s.io
+      kind: ValidatingWebhookConfiguration
+      name: <fullname>-admission
+      jqPathExpressions:
+      - '.webhooks[]?.clientConfig.caBundle'
+```
+where `<fullname>` is output of `{{"{{"}} include "vm-operator.fullname" {{"}}"}}` for your setup
+
 ## Upgrade guide
 
  During release an issue with helm CRD was discovered. So for upgrade from version less then 0.1.3 you have to two options:
@@ -137,4 +169,4 @@ The following tables lists the configurable parameters of the chart and their de
 
 Change the values according to the need of the environment in ``victoria-metrics-operator/values.yaml`` file.
 
-{{ template "chart.valuesTable" . }}
+{{ template "chart.valuesTable" . }}

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/RELEASE_NOTES.md

@@ -1,10 +1,9 @@
-# Release notes for version 0.26.0
+# Release notes for version 0.34.5
 
-**Release date:** 2023-08-30
+**Release date:** 2024-08-26
 
-![AppVersion: 0.37.0](https://img.shields.io/static/v1?label=AppVersion&message=0.37.0&color=success&logo=)
+![AppVersion: v0.47.2](https://img.shields.io/static/v1?label=AppVersion&message=v0.47.2&color=success&logo=)
 ![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
 
-- Bump operator version to [v0.37.0](https://github.com/VictoriaMetrics/operator/releases/tag/v0.37.0)
-- `psp_auto_creation_enabled` for operator is disabled by default
+- fixes typo at clean webhook. vmlogs->vlogs.
 

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/.helmignore

@@ -0,0 +1,22 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/CHANGELOG.md

@@ -0,0 +1,52 @@
+# CHANGELOG for `victoria-metrics-common` helm-chart
+
+## Next release
+
+- TODO
+
+## 0.0.5
+
+**Release date:** 2024-08-26
+
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- Fixed `vm.enterprise.only` template to check if at least one of both global.licence.eula and .Values.license.eula are defined
+- Convert `vm.args` bool `true` values to flags without values
+
+## 0.0.4
+
+**Release date:** 2024-08-26
+
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- Updated `vm.probe.*` templates to remove Helm 3.14 restriction.
+- Added `vm.args` template for cmd args generation
+
+## 0.0.3
+
+**Release date:** 2024-08-25
+
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- Moved license templates from other charts `vm.license.volume`, `vm.license.mount`, `vm.license.flag`
+- Moved `vm.compatibility.renderSecurityContext` template
+- Fixed a case, when null is passed to a `.Values.global`. See [this issue](https://github.com/VictoriaMetrics/helm-charts/issues/1296)
+
+## 0.0.2
+
+**Release date:** 2024-08-23
+
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- Added `vm.port.from.flag` template to extract port from cmd flag listen address.
+
+## 0.0.1
+
+**Release date:** 2024-08-15
+
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- Added `vm.enterprise.only` template to fail rendering if required license arguments weren't set.
+- Added `vm.image` template that introduces common chart logic of how to build image name from application variables.
+- Added `vm.ingress.port` template to render properly tngress port configuration depending on args type.
+- Added `vm.probe.*` templates to render probes params consistently across all templates.

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/Chart.lock

@@ -0,0 +1,3 @@
+dependencies: []
+digest: sha256:643d5437104296e21d906ecb15b2c96ad278f20cfc4af53b12bb6069bd853726
+generated: "2024-08-26T09:05:08.482435078Z"

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/Chart.yaml

@@ -0,0 +1,29 @@
+annotations:
+  artifacthub.io/category: monitoring-logging
+  artifacthub.io/changes: |
+    - Fixed `vm.enterprise.only` template to check if at least one of both global.licence.eula and .Values.license.eula are defined
+    - Convert `vm.args` bool `true` values to flags without values
+  artifacthub.io/license: Apache-2.0
+  artifacthub.io/links: |
+    - name: Sources
+      url: https://github.com/VictoriaMetrics/helm-charts
+    - name: Charts repo
+      url: https://victoriametrics.github.io/helm-charts/
+apiVersion: v2
+description: Victoria Metrics Common - contains shared templates for all Victoria
+  Metrics helm charts
+keywords:
+- victoriametrics
+- monitoring
+- kubernetes
+- observability
+- tsdb
+- metrics
+- metricsql
+- timeseries
+kubeVersion: '>=1.23.0-0'
+name: victoria-metrics-common
+sources:
+- https://github.com/VictoriaMetrics/helm-charts
+type: library
+version: 0.0.5

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/RELEASE_NOTES.md

@@ -0,0 +1,9 @@
+# Release notes for version 0.0.5
+
+**Release date:** 2024-08-26
+
+![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+- Fixed `vm.enterprise.only` template to check if at least one of both global.licence.eula and .Values.license.eula are defined
+- Convert `vm.args` bool `true` values to flags without values
+

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_enterprise.tpl

@@ -0,0 +1,61 @@
+{{- define "vm.license.secret.key" -}}
+{{- ((.Values.license).secret).key | default (((.Values.global).license).secret).key | default "" -}}
+{{- end -}}
+
+{{- define "vm.license.secret.name" -}}
+{{- ((.Values.license).secret).name | default (((.Values.global).license).secret).name | default "" -}}
+{{- end -}}
+
+{{- define "vm.license.key" -}}
+{{- (.Values.license).key | default ((.Values.global).license).key | default "" -}}
+{{- end -}}
+
+{{- define "vm.enterprise.only" -}}
+  {{- $licenseKey := (include "vm.license.key" .) -}}
+  {{- $licenseSecretKey := (include "vm.license.secret.key" .) -}}
+  {{- $licenseSecretName := (include "vm.license.secret.name" .) -}}
+  {{- $eula := or .Values.eula ((.Values.global).eula | default false) -}}
+  {{- if and (empty $licenseKey) (and (empty $licenseSecretName) (empty $licenseSecretKey)) (not $eula) -}}
+    {{ fail "Pass -eula command-line flag or valid license at .Values.license or .Values.global.license if you have an enterprise license for running this software. See https://victoriametrics.com/legal/esa/ for details"}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Return license volume mount
+*/}}
+{{- define "vm.license.volume" -}}
+{{- $licenseSecretKey := (include "vm.license.secret.key" .) -}}
+{{- $licenseSecretName := (include "vm.license.secret.name" .) -}}
+{{- if and $licenseSecretName $licenseSecretKey -}}
+- name: license-key
+  secret:
+    secretName: {{ $licenseSecretName }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return license volume mount for container
+*/}}
+{{- define "vm.license.mount" -}}
+{{- $licenseSecretKey := (include "vm.license.secret.key" .) -}}
+{{- $licenseSecretName := (include "vm.license.secret.name" .) -}}
+{{- if and $licenseSecretName $licenseSecretKey -}}
+- name: license-key
+  mountPath: /etc/vm-license-key
+  readOnly: true
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return license flag if necessary.
+*/}}
+{{- define "vm.license.flag" -}}
+{{- $licenseKey := (include "vm.license.key" .) -}}
+{{- $licenseSecretKey := (include "vm.license.secret.key" .) -}}
+{{- $licenseSecretName := (include "vm.license.secret.name" .) -}}
+{{- if $licenseKey -}}
+license: {{ $licenseKey }}
+{{- else if and $licenseSecretName $licenseSecretKey -}}
+licenseFile: /etc/vm-license-key/{{ $licenseSecretKey }}
+{{- end -}}
+{{- end -}}

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_image.tpl

@@ -0,0 +1,17 @@
+{{/*
+Victoria Metrics Image
+*/}}
+{{- define "vm.image" -}}
+{{- $image := (printf "%s:%s" .app.image.repository (.app.image.tag | default .Chart.AppVersion)) -}}
+{{- $license := .Values.license | default dict }}
+{{- if and (or $license.key .Values.eula (dig "secret" "name" "" $license)) (empty .app.image.tag) -}}
+  {{- $_ := set .app.image "variant" "enterprise" -}}
+{{- end -}}
+{{- with .app.image.variant -}}
+  {{- $image = (printf "%s-%s" $image .) -}}
+{{- end -}}
+{{- with .app.image.registry | default ((.Values.global).image).registry | default "" -}}
+  {{- $image = (printf "%s/%s" . $image) -}}
+{{- end -}}
+{{- $image -}}
+{{- end -}}

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_ingress.tpl

@@ -0,0 +1,8 @@
+{{- define "vm.ingress.port" }}
+{{- $port := dict "name" "http" }}
+{{- with .port }}
+  {{- $numberTypes := list "int" "float64" }}
+  {{- $port = dict (ternary "number" "name" (has (kindOf .) $numberTypes)) . }}
+{{- end -}}
+{{- toYaml $port -}}
+{{- end }}

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/charts/victoria-metrics-common/templates/_pod.tpl

@@ -0,0 +1,111 @@
+{{- define "vm.port.from.flag" -}}
+{{- $port := .default -}}
+{{- with .flag -}}
+{{- $port = regexReplaceAll ".*:(\\d+)" . "${1}" -}}
+{{- end -}}
+{{- $port -}}
+{{- end }}
+
+{{- /*
+Return true if the detected platform is Openshift
+Usage:
+{{- include "vm.compatibility.isOpenshift" . -}}
+*/ -}}
+{{- define "vm.compatibility.isOpenshift" -}}
+{{- if .Capabilities.APIVersions.Has "security.openshift.io/v1" -}}
+{{- true -}}
+{{- end -}}
+{{- end -}}
+
+{{- /*
+Render a compatible securityContext depending on the platform. By default it is maintained as it is. In other platforms like Openshift we remove default user/group values that do not work out of the box with the restricted-v1 SCC
+Usage:
+{{- include "vm.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) -}}
+*/ -}}
+{{- define "vm.compatibility.renderSecurityContext" -}}
+{{- $adaptedContext := .secContext -}}
+{{- $adaptSecurityCtx := ((((.context.Values).global).compatibility).openshift).adaptSecurityContext | default "" -}}
+{{- if or (eq $adaptSecurityCtx "force") (and (eq $adaptSecurityCtx "auto") (include "vm.compatibility.isOpenshift" .context)) -}}
+  {{- /* Remove incompatible user/group values that do not work in Openshift out of the box */ -}}
+  {{- $adaptedContext = omit $adaptedContext "fsGroup" "runAsUser" "runAsGroup" -}}
+  {{- if not .secContext.seLinuxOptions -}} 
+    {{- /* If it is an empty object, we remove it from the resulting context because it causes validation issues */ -}}
+    {{- $adaptedContext = omit $adaptedContext "seLinuxOptions" -}}
+  {{- end -}}
+{{- end -}}
+{{- omit $adaptedContext "enabled" | toYaml -}}
+{{- end -}}
+
+{{- /*
+Render probe
+*/ -}}
+{{- define "vm.probe" -}}
+  {{- /* undefined value */ -}}
+  {{- $null := (fromYaml "value: null").value -}}
+  {{- $probe := dig .type (default dict) .app.probe -}}
+  {{- $probeType := "" -}}
+  {{- $defaultProbe := default dict -}}
+  {{- if ne (dig "httpGet" $null $probe) $null -}}
+    {{- /* httpGet probe */ -}}
+    {{- $defaultProbe = dict "path" (include "vm.probe.http.path" .) "scheme" (include "vm.probe.http.scheme" .) "port" (include "vm.probe.port" .) -}}
+    {{- $probeType = "httpGet" -}}
+  {{- else if ne (dig "tcpSocket" $null $probe) $null -}}
+    {{- /* tcpSocket probe */ -}}
+    {{- $defaultProbe = dict "port" (include "vm.probe.port" .) -}}
+    {{- $probeType = "tcpSocket" -}}
+  {{- end -}}
+  {{- $defaultProbe = ternary (default dict) (dict $probeType $defaultProbe) (empty $probeType) -}}
+  {{- $probe = mergeOverwrite $defaultProbe $probe -}}
+  {{- range $key, $value := $probe -}}
+    {{- if and (has (kindOf $value) (list "object" "map")) (ne $key $probeType) -}}
+      {{- $_ := unset $probe $key -}}
+    {{- end -}}
+  {{- end -}}
+  {{- tpl (toYaml $probe) . -}}
+{{- end -}}
+
+{{- /*
+HTTP GET probe path
+*/ -}}
+{{- define "vm.probe.http.path" -}}
+{{- index .app.extraArgs "http.pathPrefix" | default "" | trimSuffix "/" -}}/health
+{{- end -}}
+
+{{- /*
+HTTP GET probe scheme
+*/ -}}
+{{- define "vm.probe.http.scheme" -}}
+{{- ternary "HTTPS" "HTTP" (.app.extraArgs.tls | default false) -}}
+{{- end -}}
+
+{{- /*
+Net probe port
+*/ -}}
+{{- define "vm.probe.port" -}}
+{{- dig "ports" "name" "http" (.app | dict) -}}
+{{- end -}}
+
+{{- define "vm.arg" -}}
+{{- if and (kindIs "bool" .value) .value -}}
+-{{ .key }}
+{{- else -}}
+-{{ .key }}={{ .value }}
+{{- end -}}
+{{- end -}}
+
+{{- /*
+command line arguments
+*/ -}}
+{{- define "vm.args" -}}
+{{- $args := default list -}}
+{{- range $key, $value := . -}}
+{{- if kindIs "slice" $value -}}
+{{- range $v := $value -}}
+{{- $args = append $args (include "vm.arg" (dict "key" $key "value" $v)) -}}
+{{- end -}}
+{{- else -}}
+{{- $args = append $args (include "vm.arg" (dict "key" $key "value" $value)) -}}
+{{- end -}}
+{{- end -}}
+{{- toYaml $args -}}
+{{- end -}}

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/_helpers.tpl

@@ -47,7 +47,10 @@ Selector labels
 */}}
 {{- define "vm-operator.selectorLabels" -}}
 app.kubernetes.io/name: {{ include "vm-operator.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- with .extraLabels }}
+{{ toYaml . }}
+{{- end }}
 {{- end -}}
 
 {{/*
@@ -56,7 +59,16 @@ Create unified labels for vm-operator components
 {{- define "vm-operator.labels" -}}
 {{- include "vm-operator.selectorLabels" . }}
 helm.sh/chart: {{ include "vm-operator.chart" . }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
+app.kubernetes.io/managed-by: {{ .Release.Service | trunc 63 | trimSuffix "-" }}
+{{- end -}}
+
+{{/*
+Create unified annotations for vm-operator components
+*/}}
+{{- define "vm-operator.annotations" -}}
+helm.sh/resource-policy: keep
+meta.helm.sh/release-namespace: {{ .Release.Namespace }}
+meta.helm.sh/release-name: {{ .Release.Name }}
 {{- end -}}
 
 {{/*
@@ -65,3 +77,43 @@ Create the name of service account and clusterRole for cleanup-hook
 {{- define "vm-operator.cleanupHookName" -}}
 {{- printf "%s-%s" (include "vm-operator.fullname" .) "cleanup-hook" | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
+
+{{/*
+Generate certificates for webhook
+*/}}
+{{- define "vm-operator.certs" -}}
+{{- $webhook := .Values.admissionWebhooks -}}
+{{- $tls := $webhook.tls -}}
+{{- $serviceName := (include "vm-operator.fullname" .) -}}
+{{- $secretName := (printf "%s-validation" $serviceName) -}}
+{{- $secret := lookup "v1" "Secret" .Release.Namespace $secretName -}}
+{{- if (and $tls.caCert $tls.cert $tls.key) -}}
+caCert: {{ $tls.caCert | b64enc }}
+clientCert: {{ $tls.cert | b64enc }}
+clientKey: {{ $tls.key | b64enc }}
+{{- else if and $webhook.keepTLSSecret $secret -}}
+caCert: {{ index $secret.data "ca.crt" }}
+clientCert: {{ index $secret.data "tls.crt" }}
+clientKey: {{ index $secret.data "tls.key" }}
+{{- else -}}
+{{- $altNames := default list -}}
+{{- $namePrefix := (printf "%s.%s" $serviceName .Release.Namespace) -}}
+{{- $altNames = append $altNames $namePrefix -}}
+{{- $altNames = append $altNames (printf "%s.svc" $namePrefix) -}}
+{{- $altNames = append $altNames (printf "%s.svc.%s" $namePrefix .Values.global.cluster.dnsDomain) -}}
+{{- $ca := genCA "vm-operator-ca" 3650 -}}
+{{- $cert := genSignedCert $serviceName nil $altNames 3650 $ca -}}
+caCert: {{ $ca.Cert | b64enc }}
+clientCert: {{ $cert.Cert | b64enc }}
+clientKey: {{ $cert.Key | b64enc }}
+{{- end -}}
+{{- end -}}
+
+
+{{/*
+Pluralize CRD name.
+All CRDs apart from "vlogs" should be pluralized. "vlogs" plural form is "vlogs".
+*/}}
+{{- define "vm-operator.pluralise_crd" -}}
+{{ (eq . "vlogs") | ternary . (printf "%ss" .) }}
+{{- end -}}

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/certmanager.yaml

@@ -1,57 +0,0 @@
-{{- if .Values.admissionWebhooks.certManager.enabled -}}
-{{- if not .Values.admissionWebhooks.certManager.issuer -}}
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: {{ template "vm-operator.fullname" . }}-root
-  namespace: {{ .Release.Namespace }}
-spec:
-  selfSigned: {}
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: {{ template "vm-operator.fullname" . }}-root-ca
-  namespace: {{ .Release.Namespace }}
-spec:
-  secretName: {{ template "vm-operator.fullname" . }}-root-ca
-  duration: 63800h0m0s
-  issuerRef:
-    name: {{ template "vm-operator.fullname" . }}-root
-  commonName: "ca.validation.victoriametrics"
-  isCA: true
----
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: {{ template "vm-operator.fullname" . }}-issuer
-  namespace: {{ .Release.Namespace }}
-spec:
-  ca:
-    secretName: {{ template "vm-operator.fullname" . }}-root-ca
-{{- end }}
----
-# actual cert part for operator
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: {{ template "vm-operator.fullname" . }}-validation
-  namespace: {{ .Release.Namespace }}
-spec:
-  secretName: {{ template "vm-operator.fullname" . }}-validation
-  duration: 45800h0m0s
-  issuerRef:
-    {{- if .Values.admissionWebhooks.certManager.issuer }}
-    {{- range $k, $v :=  .Values.admissionWebhooks.certManager.issuer }}
-     {{ $k}}: {{ $v}}
-    {{- end }}
-    {{- else }}
-    name: {{ template "vm-operator.fullname" . }}-issuer
-  {{- end }}
-  dnsNames:
-    - {{ template "vm-operator.fullname" . }}
-    - {{ template "vm-operator.fullname" . }}.{{ .Release.Namespace }}
-    - {{ template "vm-operator.fullname" . }}.{{ .Release.Namespace }}.svc
-{{- end -}}
-
-

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/cluster_role.yaml

@@ -12,19 +12,19 @@ rules:
   - configmaps
   - configmaps/finalizers
   verbs:
-  - '*'
+  - "*"
 - apiGroups:
   - ""
   resources:
   - endpoints
   verbs:
-  - '*'
+  - "*"
 - apiGroups:
   - ""
   resources:
   - events
   verbs:
-  - '*'
+  - "*"
 - apiGroups:
   - ""
   resources:
@@ -39,446 +39,193 @@ rules:
   - persistentvolumeclaims
   - persistentvolumeclaims/finalizers
   verbs:
-  - '*'
+  - "*"
 - apiGroups:
   - ""
   resources:
   - pods
   verbs:
-  - '*'
+  - "*"
 - apiGroups:
   - ""
   resources:
   - secrets
   - secrets/finalizers
   verbs:
-  - '*'
+  - "*"
 - apiGroups:
   - ""
   resources:
   - services
+  - services/finalizers
   verbs:
-  - '*'
+  - "*"
 - apiGroups:
   - ""
   resources:
-  - services/finalizers
+    - serviceaccounts
+    - serviceaccounts/finalizers
   verbs:
-  - '*'
+  - "*"
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  - nodes/proxy
+  - services
+  - endpoints
+  - pods
+  - endpointslices
+  - configmaps
+  - nodes/metrics
+  - namespaces
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - apps
   resources:
   - deployments
   - deployments/finalizers
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resources:
   - replicasets
-  verbs:
-  - '*'
-- apiGroups:
-  - apps
-  resources:
   - statefulsets
   - statefulsets/finalizers
   - statefulsets/status
   verbs:
-  - '*'
+  - "*"
 - apiGroups:
   - monitoring.coreos.com
   resources:
-  - '*'
+  - "*"
   verbs:
-  - '*'
+  - "*"
 - apiGroups:
   - operator.victoriametrics.com
   resources:
+  - vlogs
+  - vlogs/finalizers
   - vmagents
   - vmagents/finalizers
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - operator.victoriametrics.com
-  resources:
-  - vmagents/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - operator.victoriametrics.com
-  resources:
   - vmalertmanagers
   - vmalertmanagers/finalizers
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - operator.victoriametrics.com
-  resources:
-  - vmalertmanagers/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - operator.victoriametrics.com
-  resources:
   - vmalertmanagerconfigs
   - vmalertmanagerconfigs/finalizers
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - operator.victoriametrics.com
-  resources:
-  - vmalertmanagerconfigss/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - operator.victoriametrics.com
-  resources:
   - vmalerts
   - vmalerts/finalizers
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - operator.victoriametrics.com
-  resources:
-  - vmalerts/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - operator.victoriametrics.com
-  resources:
-  - vmclusters
-  - vmclusters/finalizers
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - operator.victoriametrics.com
-  resources:
-  - vmclusters/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - operator.victoriametrics.com
-  resources:
-  - vmpodscrapes
-  - vmprobscrapes/finalizers
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - operator.victoriametrics.com
-  resources:
-  - vmpodscrapes/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - operator.victoriametrics.com
-  resources:
-  - vmrules
-  - vmrules/finalizers
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - operator.victoriametrics.com
-  resources:
-  - vmrules/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - operator.victoriametrics.com
-  resources:
-  - vmservicescrapes
-  - vmservicescrapes/finalizers
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - operator.victoriametrics.com
-  resources:
-  - vmservicescrapes/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - operator.victoriametrics.com
-  resources:
-  - vmprobes
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - operator.victoriametrics.com
-  resources:
-  - vmprobes/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-  - operator.victoriametrics.com
-  resources:
-  - vmsingles
-  - vmsingles/finalizers
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - operator.victoriametrics.com
-  resources:
-  - vmsingles/status
-  verbs:
-  - get
-  - patch
-  - update
-- apiGroups:
-    - ""
-  resources:
-    - nodes
-    - nodes/proxy
-    - services
-    - endpoints
-    - pods
-    - endpointslices
-    - configmaps
-    - nodes/metrics
-    - namespaces
-  verbs:
-    - get
-    - list
-    - watch
-- apiGroups:
-    - "extensions"
-    - "networking.k8s.io"
-  resources:
-    - ingresses
-  verbs:
-    - get
-    - list
-    - watch
-- nonResourceURLs:
-    - "/metrics"
-    - "/metrics/resources"
-  verbs:
-    - get
-    - watch
-    - list
-- apiGroups:
-    - "rbac.authorization.k8s.io"
-  resources:
-    - clusterrolebindings
-    - clusterrolebindings/finalizers
-    - clusterroles
-    - clusterroles/finalizers
-    - roles
-    - rolebindings
-  verbs:
-    - get
-    - list
-    - create
-    - patch
-    - update
-    - watch
-    - delete
-- apiGroups:
-    - "policy"
-  resources:
-    - podsecuritypolicies
-    - podsecuritypolicies/finalizers
-  verbs:
-    - get
-    - list
-    - create
-    - patch
-    - update
-    - use
-    - watch
-    - delete
-- apiGroups:
-    - ""
-  resources:
-    - serviceaccounts
-    - serviceaccounts/finalizers
-  verbs:
-    - get
-    - list
-    - create
-    - watch
-    - update
-    - delete
-- apiGroups:
-    - operator.victoriametrics.com
-  resources:
-    - vmnodescrapes
-    - vmnodescrapes/finalizers
-  verbs:
-    - create
-    - delete
-    - get
-    - list
-    - patch
-    - update
-    - watch
-- apiGroups:
-    - operator.victoriametrics.com
-  resources:
-    - vmnodescrapes/status
-  verbs:
-    - get
-    - patch
-    - update
-- apiGroups:
-    - operator.victoriametrics.com
-  resources:
-    - vmstaticscrapes
-    - vmstaticscrapes/finalizers
-  verbs:
-    - create
-    - delete
-    - get
-    - list
-    - patch
-    - update
-    - watch
-- apiGroups:
-    - operator.victoriametrics.com
-  resources:
-    - vmstaticscrapes/status
-  verbs:
-    - get
-    - patch
-    - update
-- apiGroups:
-    - operator.victoriametrics.com
-  resources:
   - vmauths
   - vmauths/finalizers
   - vmusers
   - vmusers/finalizers
+  - vmclusters
+  - vmclusters/finalizers
+  - vmpodscrapes
+  - vmpodscrapes/finalizers
+  - vmrules
+  - vmrules/finalizers
+  - vmservicescrapes
+  - vmservicescrapes/finalizers
+  - vmprobes
+  - vmprobes/finalizers
+  - vmsingles
+  - vmsingles/finalizers
+  - vmnodescrapes
+  - vmnodescrapes/finalizers
+  - vmstaticscrapes
+  - vmstaticscrapes/finalizers
+  - vmscrapeconfigs
+  - vmscrapeconfigs/finalizers
+  verbs:
+      - '*'
+- apiGroups:
+  - operator.victoriametrics.com
+  resources:
+  - vlogs/status
+  - vmagents/status
+  - vmalertmanagers/status
+  - vmalertmanagerconfigs/status
+  - vmalerts/status
+  - vmclusters/status
+  - vmpodscrapes/status
+  - vmscrapeconfigs/status
+  - vmrules/status
+  - vmservicescrapes/status
+  - vmprobes/status
+  - vmsingles/status
+  - vmscrapeconfig/status
+  - vmusers/status
+  - vmauths/status
+  - vmstaticscrapes/status
+  - vmnodescrapes/status
   verbs:
-  - create
-  - delete
   - get
-  - list
   - patch
   - update
+- apiGroups:
+  - extensions
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - get
+  - list
+  - watch
+- nonResourceURLs:
+  - /metrics
+  - /metrics/resources
+  verbs:
+  - get
+  - watch
+  - list
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - clusterrolebindings
+  - clusterrolebindings/finalizers
+  - clusterroles
+  - clusterroles/finalizers
+  - roles
+  - rolebindings
+  verbs:
+  - "*"
+- apiGroups:
+  - storage.k8s.io
+  resources:
+  - storageclasses
+  verbs:
+  - list
+  - get
   - watch
 - apiGroups:
-    - operator.victoriametrics.com
+  - policy
   resources:
-    - vmusers/status
-    - vmauths/status
+  - poddisruptionbudgets
+  - poddisruptionbudgets/finalizers
   verbs:
-    - get
-    - patch
-    - update
+  - "*"
 - apiGroups:
-    - storage.k8s.io
+  - route.openshift.io
+  - image.openshift.io
   resources:
-    - storageclasses
+  - routers/metrics
+  - registry/metrics
   verbs:
-    - list
-    - get
-    - watch
+  - get
 - apiGroups:
-    - policy
+  - autoscaling
+  verbs:
+  - "*"
   resources:
-    - poddisruptionbudgets
-    - poddisruptionbudgets/finalizers
-  verbs:
-    - '*'
+  - horizontalpodautoscalers
 - apiGroups:
-    - route.openshift.io
-    - image.openshift.io
-  resources:
-    - routers/metrics
-    - registry/metrics
-  verbs:
-    - get
-- apiGroups:
-    - autoscaling
-  verbs:
-    - list
-    - get
-    - delete
-    - create
-    - update
-    - watch
-  resources:
-    - horizontalpodautoscalers
-- apiGroups:
-    - networking.k8s.io
-    - extensions
+  - networking.k8s.io
+  - extensions
   resources:
   - ingresses
   - ingresses/finalizers
@@ -490,10 +237,18 @@ rules:
   - update
   - watch
 - apiGroups:
-    - apiextensions.k8s.io
+  - apiextensions.k8s.io
   resources:
-    - customresourcedefinitions
+  - customresourcedefinitions
   verbs:
-    - get
-    - list
+  - get
+  - list
+- apiGroups:
+  - discovery.k8s.io
+  resources:
+  - endpointslices
+  verbs:
+  - list
+  - watch
+  - get
 {{- end -}}

packages/system/victoria-metrics-operator/charts/victoria-metrics-operator/templates/crd_clusterrole.yaml

@@ -0,0 +1,66 @@
+{{- /* This template generates readonly and admin cluster roles for */ -}}
+{{- /* each CRD present in the helm chart.  The clusterroles use the */ -}}
+{{- /* kubernetes clusterrole aggregation feature to include these */ -}}
+{{- /* cluster roles into the default view and admin roles */ -}}
+{{- /* See https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles */ -}}
+{{- if .Values.createCRD }}
+{{- if .Values.rbac.aggregatedClusterRoles.enabled }}
+{{- $files := .Files }}
+{{- $fileContentsList := $files.Get "crd.yaml" | splitList "---" }}
+{{- $groups := dict }}
+{{- range $fileContentsList }}
+    {{- $fileContents := . | fromYaml }}
+    {{- $group := $fileContents.spec.group }}
+    {{- $plural:= $fileContents.spec.names.plural }}
+    {{- $resources := get $groups $group | default (list) }}
+    {{- $resources := append $resources $plural }}
+    {{- $groups := set $groups $group $resources }}
+{{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: victoriametrics:admin
+  labels:
+    {{- include "vm-operator.labels" . | nindent 4 }}
+    {{- .Values.rbac.aggregatedClusterRoles.labels.admin | toYaml | nindent 4 }}
+rules:
+- apiGroups: 
+  {{- range $group, $resources := $groups }}
+  - {{ $group }}
+  resources:
+  {{- range $resource := $resources }}
+  - {{ $resource }}
+  {{- end }}
+  {{- end }}
+  verbs:
+  - create
+  - update
+  - patch
+  - delete
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: victoriametrics:view
+  labels:
+    {{- include "vm-operator.labels" . | nindent 4 }}
+    {{- .Values.rbac.aggregatedClusterRoles.labels.view | toYaml | nindent 4 }}
+rules:
+- apiGroups:
+  {{- range $group, $resources := $groups }}
+  - {{ $group }}
+  resources:
+  {{- range $resource := $resources }}
+  - {{ $resource }}
+  {{- end }}
+  {{- end }}
+  verbs:
+  - get
+  - list
+  - watch
+{{- end }}
+{{- end }}